Edit tour

Windows Analysis Report
UPDATED SSTATEMENT OF ACCOUNT.exe

Overview

General Information

Sample name:	UPDATED SSTATEMENT OF ACCOUNT.exe
Analysis ID:	1428829
MD5:	25e87d17f0c864ffdc217d43c82cc36c
SHA1:	aecd0ff1a25d22ace6ab1c9650589ca916cabf3f
SHA256:	37fda41fdb04917e4c0da2880b51ba07e959d53a31a93a9b47785a5be8807bd7
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

UPDATED SSTATEMENT OF ACCOUNT.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe" MD5: 25E87D17F0C864FFDC217D43C82CC36C)

powershell.exe (PID: 528 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6924 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 64 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2404 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6392 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 3392 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

TgfQNrhQjjseHY.exe (PID: 4460 cmdline: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe MD5: 25E87D17F0C864FFDC217D43C82CC36C)

schtasks.exe (PID: 7056 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 4548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.tabcoeng.com", "Username": "tabco@tabcoeng.com", "Password": "TaSq3365!"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2160120971.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 3392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3392	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 4548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4548	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3245b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32577:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32653:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32779:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3425b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34377:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34453:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34579:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3245b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32577:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32653:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32779:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3245b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32577:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32653:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32779:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x323e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3245b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x324e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32577:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x325e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32653:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x326e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32779:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f809:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3425b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f87b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f905:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34377:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f997:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fa01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34453:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fb09:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34579:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb99:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f809:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3425b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f87b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f905:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34377:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f997:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fa01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34453:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fb09:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34579:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb99:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6fa09:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xab029:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3425b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa7b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab09b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6fb05:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab125:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34377:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb97:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab1b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fc01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab221:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34453:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab293:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fd09:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab329:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x341e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6fa09:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xab029:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3425b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa7b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab09b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x342e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6fb05:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab125:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34377:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb97:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab1b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x343e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fc01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab221:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34453:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab293:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x344e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fd09:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab329:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 27 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 135.181.124.14, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 3392, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ParentImage: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe, ParentProcessId: 6516, ParentProcessName: UPDATED SSTATEMENT OF ACCOUNT.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ProcessId: 528, ProcessName: powershell.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 3392, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe, ParentImage: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe, ParentProcessId: 4460, ParentProcessName: TgfQNrhQjjseHY.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp", ProcessId: 7056, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ParentImage: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe, ParentProcessId: 6516, ParentProcessName: UPDATED SSTATEMENT OF ACCOUNT.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", ProcessId: 6392, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ParentImage: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe, ParentProcessId: 6516, ParentProcessName: UPDATED SSTATEMENT OF ACCOUNT.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ProcessId: 528, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe", ParentImage: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe, ParentProcessId: 6516, ParentProcessName: UPDATED SSTATEMENT OF ACCOUNT.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp", ProcessId: 6392, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.tabcoeng.com", "Username": "tabco@tabcoeng.com", "Password": "TaSq3365!"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

ReversingLabs: Detection: 36%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Joe Sandbox ML: detected

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49720 version: TLS 1.0

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: zzUBZ.pdb source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr
Source:	Binary string: zzUBZ.pdbSHA256 source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 4x nop then jmp 0178D983h		0_2_0178D0F4
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 4x nop then jmp 023DCE4Bh		9_2_023DC5D1

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 135.181.124.14:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 135.181.124.14:587

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49720 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: MSBuild.exe, 00000008.00000002.2160120971.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2160120971.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3346859108.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: MSBuild.exe, 00000008.00000002.2160120971.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.tabcoeng.com
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2141321180.0000000003251000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2160120971.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2178810898.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr	String found in binary or memory: http://tempuri.org/x.xsd?MultiGames.Properties.Resources
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr	String found in binary or memory: https://github.com/zuppao).

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, cPKWk.cs	.Net Code: iLhfhcxZ
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, cPKWk.cs	.Net Code: iLhfhcxZ

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.5910000.4.raw.unpack, LoginForm.cs

Large array initialization: : array initializer size 33603

.NET source code contains very large strings

Source: UPDATED SSTATEMENT OF ACCOUNT.exe, Form1.cs	Long String: Length: 131612
Source: TgfQNrhQjjseHY.exe.0.dr, Form1.cs	Long String: Length: 131612

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_01787190	0_2_01787190
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_017864E8	0_2_017864E8
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_01786920	0_2_01786920
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_017859E0	0_2_017859E0
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_01788838	0_2_01788838
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_0178F8E0	0_2_0178F8E0
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_01786D58	0_2_01786D58
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_0186DC74	0_2_0186DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01264AC8	8_2_01264AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_01263EB0	8_2_01263EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_012641F8	8_2_012641F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0126F6D0	8_2_0126F6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06900040	8_2_06900040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06906808	8_2_06906808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0690E9A7	8_2_0690E9A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06908940	8_2_06908940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0690B4F0	8_2_0690B4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_069034F8	8_2_069034F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06909D60	8_2_06909D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0690AE10	8_2_0690AE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06909047	8_2_06909047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06905AF8	8_2_06905AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_06900007	8_2_06900007
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_00AADC74	9_2_00AADC74
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D7190	9_2_023D7190
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D64E8	9_2_023D64E8
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D8838	9_2_023D8838
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D6920	9_2_023D6920
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D59E0	9_2_023D59E0
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023D6D58	9_2_023D6D58
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Code function: 9_2_023DEDB8	9_2_023DEDB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C94AC8	13_2_00C94AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C9CE88	13_2_00C9CE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C93EB0	13_2_00C93EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C941F8	13_2_00C941F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C9F6D0	13_2_00C9F6D0

Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2145510029.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename32633afe-7a30-4194-b5fc-3a5fc4fdc868.exe4 vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2146566265.0000000008930000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2137873922.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.0000000004C75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000000.2100247241.0000000000E0E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamezzUBZ.exe< vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2141321180.0000000003251000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename32633afe-7a30-4194-b5fc-3a5fc4fdc868.exe4 vs UPDATED SSTATEMENT OF ACCOUNT.exe
Source: UPDATED SSTATEMENT OF ACCOUNT.exe	Binary or memory string: OriginalFilenamezzUBZ.exe< vs UPDATED SSTATEMENT OF ACCOUNT.exe

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: UPDATED SSTATEMENT OF ACCOUNT.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TgfQNrhQjjseHY.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, o8FNF2SyvOrIjq11mH.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File created: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Mutant created: \Sessions\1\BaseNamedObjects\jHHFqVAHBkOyEUsNGAVZyWFA
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:64:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3564:120:WilError_03

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC678.tmp

Jump to behavior

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

ReversingLabs: Detection: 36%

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

String found in binary or memory: Save/Load

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File read: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: UPDATED SSTATEMENT OF ACCOUNT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: zzUBZ.pdb source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr
Source:	Binary string: zzUBZ.pdbSHA256 source: UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: UPDATED SSTATEMENT OF ACCOUNT.exe, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: TgfQNrhQjjseHY.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, o8FNF2SyvOrIjq11mH.cs	.Net Code: OI5QjapQfoSucKdLSo9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, o8FNF2SyvOrIjq11mH.cs	.Net Code: OI5QjapQfoSucKdLSo9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, o8FNF2SyvOrIjq11mH.cs	.Net Code: OI5QjapQfoSucKdLSo9 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.5910000.4.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Code function: 0_2_0186D89E pushfd ; ret	0_2_0186D8A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 8_2_0690E998 push eax; retf	8_2_0690E9A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C90C23 push edi; retf	13_2_00C90CAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 13_2_00C9DA24 push ecx; ret	13_2_00C9DA26

Source: UPDATED SSTATEMENT OF ACCOUNT.exe	Static PE information: section name: .text entropy: 7.318017102591194
Source: TgfQNrhQjjseHY.exe.0.dr	Static PE information: section name: .text entropy: 7.318017102591194

Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, UXUW0udg70mIAfO19dm.cs	High entropy of concatenated method names: 'hGObYYROs1', 'w5bb8LoxpS', 'reKbDoRtHP', 'gyhbL0KaHv', 'YGtb7gommS', 'l6Qb5qGElQ', 'oXKbu0b469', 'GTbbVHLNMa', 'oT5bWslBUD', 'yV5b98lPrs'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, XUlWngz4TlbqdVkh6V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XvLbwHlMxj', 'JO9bt0hiNZ', 'FmsbCP8562', 'iIVbr355kJ', 'vUtbAHuBDF', 'KGZbbnZ1TS', 'bH7bj41635'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, nPiq9cdZ7nsxoOEVMFR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VfjjipJ5jB', 'ecNjcBEFjE', 'hMsjU0XmWl', 'mc7jBjno3X', 'hDEjlyeiyp', 'EXSjHKyttM', 'QRPjNo9sHc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, ktPfB7FoodvjaClP45.cs	High entropy of concatenated method names: 'GYbwVdBgV0', 'ct9wWhPHWH', 'UCAwmZr14q', 'oW7wI1myv2', 'gPwwh8v6VZ', 'iw6wOWQEhP', 'uqvwsXyeS1', 'hgYwohn3BM', 'PhGw4Z3TXV', 'kPfwpbsgF5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, fx1x6XkTFKYRc4eMtM.cs	High entropy of concatenated method names: 'tu6dQKKRJ8', 'iFXdS4G1N1', 'HSod1fDuDj', 'vvkd0J15nH', 'eEkdtorRPL', 'B1ndC2ZUap', 'eVTAmoTbuceFLwfp9k', 'EP1cPMVxG4ouBRJqQr', 'NoLddbb0nY', 'paRdZPMMqc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, o8FNF2SyvOrIjq11mH.cs	High entropy of concatenated method names: 'OHCZEoGYXS', 'za6ZRUp1NC', 'LsfZfihH1x', 'PmqZeCABxg', 'fZBZnFtRZu', 'KgrZT24DKc', 'pdoZQDbKqR', 'HaiZSDAeXH', 'rtCZP9aj4v', 'se1Z14RjhC'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, fPL71nm2ZUapu9jmZJ.cs	High entropy of concatenated method names: 'ibhTE7WPuU', 'ayaTf2Vb8l', 'utZTn2rtoy', 'C1hTQ5Q3o8', 'kfiTSM9SbK', 'Hrinllo2QW', 'twYnHSf6EQ', 'vgmnN3BD0A', 'YaTnvVftcJ', 'FGRn35nXKu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, YM2o09BF5gx5L68j9x.cs	High entropy of concatenated method names: 'Puyr1SEOgw', 'jAWr0KQonX', 'ToString', 'GWmrRgEXER', 'mNZrfxJ7SI', 'QYlreBDUKc', 'mxxrnITVgY', 'rPPrTjJ5XC', 'thArQwQQ0J', 'eiVrSx1TM5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, KYivPAvbBoJxPUPiA2.cs	High entropy of concatenated method names: 'ChcAR844sb', 'AqdAf7XApc', 'RMpAeoWPSD', 'fWxAnQoZrk', 'xOGAThLATv', 'HwbAQ8VVH2', 'cxIASGDdpG', 'TiJAPTrgTP', 'kkLA1FCnqZ', 'h4eA0ohWfu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	High entropy of concatenated method names: 'D3dfiKS5Sp', 'rMefcvvbZK', 'SpffU7HpJA', 'Y3nfB1h5XH', 'NYFflbvhV9', 'DYCfHO444e', 'Ro7fNWUTix', 'B7nfvBrXKx', 'PPSf3hYOWA', 'SjmfJ9OJLq'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, ejlP3Oxj5VTYEvKO5r.cs	High entropy of concatenated method names: 'tZHDsgf5V', 'TqHL6fWn1', 'n4r5VkwwE', 'lcMunrfq2', 'RVYWKd0XW', 'lBY9qKXYe', 'Fx4iZHZBZDR5q6wj5U', 'hTgejTfqLGN7KQHyDI', 'MMDA6kDcf', 'DYEjtPCgx'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, TmNAWqstqFSpLbNpTE.cs	High entropy of concatenated method names: 'pyQQRlBiSp', 'E0vQe21bOq', 'McCQTqJuBH', 'yINTJekOsy', 'vY5TzynDHT', 'zAXQgYfYec', 'LR2QdtQDri', 'w0fQxrxcPL', 'mdVQZ4CeYY', 'xkXQkqk348'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, mFN8l0JlMCpR0cYUUm.cs	High entropy of concatenated method names: 'j0YbdHxUEM', 'yLAbZuoTT0', 'CmEbkWkI0T', 'VRqbRdmdvV', 'JjnbfoL9XJ', 'CW1bng2scv', 'DYFbTRNnyh', 'EpWANXpBum', 'MbQAvxSBmE', 'DPWA3vI2hG'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, kR0DFf3CmMYrZsqb6N.cs	High entropy of concatenated method names: 'PsbAmTPdsH', 'UL4AI1KolP', 'zZFAMYgyW4', 'Un6AhXQrVl', 'YZfAicwbo0', 'MkBAOySJCH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, mHKiENejJDcn6AxJbF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CMfx300hPc', 'nkTxJ5PJPg', 'ogsxz1YYcH', 'b1BZgjYLca', 'GFCZdvwC4f', 'C9EZx9j4Aj', 'JcAZZ1cK44', 'qgRnKrpWhesTAI9XFDB'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, yUquE6UMuMSijVwDGu.cs	High entropy of concatenated method names: 'ToString', 'wjeCp9TOsm', 'elwCIZR1jG', 'XLrCM6Or2t', 'B52ChAV4fs', 'Hc7COidv4y', 'r2mCqbdbRk', 'jrwCslyeRR', 'J30Co2JPTW', 'XT5C29RNwW'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, RgfDrXHKnC8jGFqB26.cs	High entropy of concatenated method names: 'UIirv4wQPb', 'W3JrJPpmbb', 'apDAg4jARg', 'rt9AdpI2cx', 'uOFrpJ8Ou2', 'UmZraxJtnF', 'jNqrF5QNWn', 'CVBriPBh2v', 'sQWrcW8ea3', 'VtorU1OQPw'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, T82yWMWSofDuDjyvkJ.cs	High entropy of concatenated method names: 'cH3eLV49E6', 'vTte5vCLHs', 'oYveVjVGRW', 'GTWeWhVeBq', 'hb4etnE68T', 'JZfeCR7GNq', 'g2nerLuvOO', 'bSyeAkjplI', 'RiiebyLH3g', 'yv2ejuWm7c'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, f9UIpU26JvmBTBSctL.cs	High entropy of concatenated method names: 'vfHQYG4MDd', 'lxLQ80Eh3u', 'QJwQDjcDQV', 'RsSQLbiuv5', 'XTdQ7qxngP', 'JvcQ5uSdXS', 'aL5QucoJJX', 'RgDQVmDUTR', 'aucQWNTHuO', 'qASQ96w7M7'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, G4wV8Gf6v2K5jjGjCT.cs	High entropy of concatenated method names: 'Dispose', 'EHid3gFA4w', 'JonxInLaGY', 'MbkXXgYQPF', 'fqYdJivPAb', 'ToJdzxPUPi', 'ProcessDialogKey', 'r2SxgR0DFf', 'pmMxdYrZsq', 'r6Nxx0FN8l'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, TeEwg8iN7vW6LLxRRW.cs	High entropy of concatenated method names: 'hOqt4bLcLD', 'qRutaW7Rmk', 'JvOtiQ1wuX', 'DcZtcWNJdC', 'fnmtIY1ulX', 'xZTtMtD2ll', 'WuCthA6ndI', 'CuCtOQdDiY', 'aRHtqNsKQm', 'zZBtsruW67'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.8930000.7.raw.unpack, KVbeayhXmtlCZ27r6N.cs	High entropy of concatenated method names: 'i3FT6EgOZd', 'L0fTYU60io', 'O7ETDqlVyd', 'Yq1TLMDMZA', 'y5HT5YVhCu', 'VlKTu3RKje', 'H9lTWInGs8', 'DR2T9rw2JC', 'v12g6V4xk1vhjN1Ug52', 'bKrGdL4boFxp9Sou1KN'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, UXUW0udg70mIAfO19dm.cs	High entropy of concatenated method names: 'hGObYYROs1', 'w5bb8LoxpS', 'reKbDoRtHP', 'gyhbL0KaHv', 'YGtb7gommS', 'l6Qb5qGElQ', 'oXKbu0b469', 'GTbbVHLNMa', 'oT5bWslBUD', 'yV5b98lPrs'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, XUlWngz4TlbqdVkh6V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XvLbwHlMxj', 'JO9bt0hiNZ', 'FmsbCP8562', 'iIVbr355kJ', 'vUtbAHuBDF', 'KGZbbnZ1TS', 'bH7bj41635'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, nPiq9cdZ7nsxoOEVMFR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VfjjipJ5jB', 'ecNjcBEFjE', 'hMsjU0XmWl', 'mc7jBjno3X', 'hDEjlyeiyp', 'EXSjHKyttM', 'QRPjNo9sHc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, ktPfB7FoodvjaClP45.cs	High entropy of concatenated method names: 'GYbwVdBgV0', 'ct9wWhPHWH', 'UCAwmZr14q', 'oW7wI1myv2', 'gPwwh8v6VZ', 'iw6wOWQEhP', 'uqvwsXyeS1', 'hgYwohn3BM', 'PhGw4Z3TXV', 'kPfwpbsgF5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, fx1x6XkTFKYRc4eMtM.cs	High entropy of concatenated method names: 'tu6dQKKRJ8', 'iFXdS4G1N1', 'HSod1fDuDj', 'vvkd0J15nH', 'eEkdtorRPL', 'B1ndC2ZUap', 'eVTAmoTbuceFLwfp9k', 'EP1cPMVxG4ouBRJqQr', 'NoLddbb0nY', 'paRdZPMMqc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, o8FNF2SyvOrIjq11mH.cs	High entropy of concatenated method names: 'OHCZEoGYXS', 'za6ZRUp1NC', 'LsfZfihH1x', 'PmqZeCABxg', 'fZBZnFtRZu', 'KgrZT24DKc', 'pdoZQDbKqR', 'HaiZSDAeXH', 'rtCZP9aj4v', 'se1Z14RjhC'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, fPL71nm2ZUapu9jmZJ.cs	High entropy of concatenated method names: 'ibhTE7WPuU', 'ayaTf2Vb8l', 'utZTn2rtoy', 'C1hTQ5Q3o8', 'kfiTSM9SbK', 'Hrinllo2QW', 'twYnHSf6EQ', 'vgmnN3BD0A', 'YaTnvVftcJ', 'FGRn35nXKu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, YM2o09BF5gx5L68j9x.cs	High entropy of concatenated method names: 'Puyr1SEOgw', 'jAWr0KQonX', 'ToString', 'GWmrRgEXER', 'mNZrfxJ7SI', 'QYlreBDUKc', 'mxxrnITVgY', 'rPPrTjJ5XC', 'thArQwQQ0J', 'eiVrSx1TM5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, KYivPAvbBoJxPUPiA2.cs	High entropy of concatenated method names: 'ChcAR844sb', 'AqdAf7XApc', 'RMpAeoWPSD', 'fWxAnQoZrk', 'xOGAThLATv', 'HwbAQ8VVH2', 'cxIASGDdpG', 'TiJAPTrgTP', 'kkLA1FCnqZ', 'h4eA0ohWfu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	High entropy of concatenated method names: 'D3dfiKS5Sp', 'rMefcvvbZK', 'SpffU7HpJA', 'Y3nfB1h5XH', 'NYFflbvhV9', 'DYCfHO444e', 'Ro7fNWUTix', 'B7nfvBrXKx', 'PPSf3hYOWA', 'SjmfJ9OJLq'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, ejlP3Oxj5VTYEvKO5r.cs	High entropy of concatenated method names: 'tZHDsgf5V', 'TqHL6fWn1', 'n4r5VkwwE', 'lcMunrfq2', 'RVYWKd0XW', 'lBY9qKXYe', 'Fx4iZHZBZDR5q6wj5U', 'hTgejTfqLGN7KQHyDI', 'MMDA6kDcf', 'DYEjtPCgx'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, TmNAWqstqFSpLbNpTE.cs	High entropy of concatenated method names: 'pyQQRlBiSp', 'E0vQe21bOq', 'McCQTqJuBH', 'yINTJekOsy', 'vY5TzynDHT', 'zAXQgYfYec', 'LR2QdtQDri', 'w0fQxrxcPL', 'mdVQZ4CeYY', 'xkXQkqk348'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, mFN8l0JlMCpR0cYUUm.cs	High entropy of concatenated method names: 'j0YbdHxUEM', 'yLAbZuoTT0', 'CmEbkWkI0T', 'VRqbRdmdvV', 'JjnbfoL9XJ', 'CW1bng2scv', 'DYFbTRNnyh', 'EpWANXpBum', 'MbQAvxSBmE', 'DPWA3vI2hG'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, kR0DFf3CmMYrZsqb6N.cs	High entropy of concatenated method names: 'PsbAmTPdsH', 'UL4AI1KolP', 'zZFAMYgyW4', 'Un6AhXQrVl', 'YZfAicwbo0', 'MkBAOySJCH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, mHKiENejJDcn6AxJbF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CMfx300hPc', 'nkTxJ5PJPg', 'ogsxz1YYcH', 'b1BZgjYLca', 'GFCZdvwC4f', 'C9EZx9j4Aj', 'JcAZZ1cK44', 'qgRnKrpWhesTAI9XFDB'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, yUquE6UMuMSijVwDGu.cs	High entropy of concatenated method names: 'ToString', 'wjeCp9TOsm', 'elwCIZR1jG', 'XLrCM6Or2t', 'B52ChAV4fs', 'Hc7COidv4y', 'r2mCqbdbRk', 'jrwCslyeRR', 'J30Co2JPTW', 'XT5C29RNwW'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, RgfDrXHKnC8jGFqB26.cs	High entropy of concatenated method names: 'UIirv4wQPb', 'W3JrJPpmbb', 'apDAg4jARg', 'rt9AdpI2cx', 'uOFrpJ8Ou2', 'UmZraxJtnF', 'jNqrF5QNWn', 'CVBriPBh2v', 'sQWrcW8ea3', 'VtorU1OQPw'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, T82yWMWSofDuDjyvkJ.cs	High entropy of concatenated method names: 'cH3eLV49E6', 'vTte5vCLHs', 'oYveVjVGRW', 'GTWeWhVeBq', 'hb4etnE68T', 'JZfeCR7GNq', 'g2nerLuvOO', 'bSyeAkjplI', 'RiiebyLH3g', 'yv2ejuWm7c'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, f9UIpU26JvmBTBSctL.cs	High entropy of concatenated method names: 'vfHQYG4MDd', 'lxLQ80Eh3u', 'QJwQDjcDQV', 'RsSQLbiuv5', 'XTdQ7qxngP', 'JvcQ5uSdXS', 'aL5QucoJJX', 'RgDQVmDUTR', 'aucQWNTHuO', 'qASQ96w7M7'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, G4wV8Gf6v2K5jjGjCT.cs	High entropy of concatenated method names: 'Dispose', 'EHid3gFA4w', 'JonxInLaGY', 'MbkXXgYQPF', 'fqYdJivPAb', 'ToJdzxPUPi', 'ProcessDialogKey', 'r2SxgR0DFf', 'pmMxdYrZsq', 'r6Nxx0FN8l'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, TeEwg8iN7vW6LLxRRW.cs	High entropy of concatenated method names: 'hOqt4bLcLD', 'qRutaW7Rmk', 'JvOtiQ1wuX', 'DcZtcWNJdC', 'fnmtIY1ulX', 'xZTtMtD2ll', 'WuCthA6ndI', 'CuCtOQdDiY', 'aRHtqNsKQm', 'zZBtsruW67'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4fbeaf8.1.raw.unpack, KVbeayhXmtlCZ27r6N.cs	High entropy of concatenated method names: 'i3FT6EgOZd', 'L0fTYU60io', 'O7ETDqlVyd', 'Yq1TLMDMZA', 'y5HT5YVhCu', 'VlKTu3RKje', 'H9lTWInGs8', 'DR2T9rw2JC', 'v12g6V4xk1vhjN1Ug52', 'bKrGdL4boFxp9Sou1KN'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, UXUW0udg70mIAfO19dm.cs	High entropy of concatenated method names: 'hGObYYROs1', 'w5bb8LoxpS', 'reKbDoRtHP', 'gyhbL0KaHv', 'YGtb7gommS', 'l6Qb5qGElQ', 'oXKbu0b469', 'GTbbVHLNMa', 'oT5bWslBUD', 'yV5b98lPrs'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, XUlWngz4TlbqdVkh6V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XvLbwHlMxj', 'JO9bt0hiNZ', 'FmsbCP8562', 'iIVbr355kJ', 'vUtbAHuBDF', 'KGZbbnZ1TS', 'bH7bj41635'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, nPiq9cdZ7nsxoOEVMFR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VfjjipJ5jB', 'ecNjcBEFjE', 'hMsjU0XmWl', 'mc7jBjno3X', 'hDEjlyeiyp', 'EXSjHKyttM', 'QRPjNo9sHc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, ktPfB7FoodvjaClP45.cs	High entropy of concatenated method names: 'GYbwVdBgV0', 'ct9wWhPHWH', 'UCAwmZr14q', 'oW7wI1myv2', 'gPwwh8v6VZ', 'iw6wOWQEhP', 'uqvwsXyeS1', 'hgYwohn3BM', 'PhGw4Z3TXV', 'kPfwpbsgF5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, fx1x6XkTFKYRc4eMtM.cs	High entropy of concatenated method names: 'tu6dQKKRJ8', 'iFXdS4G1N1', 'HSod1fDuDj', 'vvkd0J15nH', 'eEkdtorRPL', 'B1ndC2ZUap', 'eVTAmoTbuceFLwfp9k', 'EP1cPMVxG4ouBRJqQr', 'NoLddbb0nY', 'paRdZPMMqc'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, o8FNF2SyvOrIjq11mH.cs	High entropy of concatenated method names: 'OHCZEoGYXS', 'za6ZRUp1NC', 'LsfZfihH1x', 'PmqZeCABxg', 'fZBZnFtRZu', 'KgrZT24DKc', 'pdoZQDbKqR', 'HaiZSDAeXH', 'rtCZP9aj4v', 'se1Z14RjhC'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, fPL71nm2ZUapu9jmZJ.cs	High entropy of concatenated method names: 'ibhTE7WPuU', 'ayaTf2Vb8l', 'utZTn2rtoy', 'C1hTQ5Q3o8', 'kfiTSM9SbK', 'Hrinllo2QW', 'twYnHSf6EQ', 'vgmnN3BD0A', 'YaTnvVftcJ', 'FGRn35nXKu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, YM2o09BF5gx5L68j9x.cs	High entropy of concatenated method names: 'Puyr1SEOgw', 'jAWr0KQonX', 'ToString', 'GWmrRgEXER', 'mNZrfxJ7SI', 'QYlreBDUKc', 'mxxrnITVgY', 'rPPrTjJ5XC', 'thArQwQQ0J', 'eiVrSx1TM5'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, KYivPAvbBoJxPUPiA2.cs	High entropy of concatenated method names: 'ChcAR844sb', 'AqdAf7XApc', 'RMpAeoWPSD', 'fWxAnQoZrk', 'xOGAThLATv', 'HwbAQ8VVH2', 'cxIASGDdpG', 'TiJAPTrgTP', 'kkLA1FCnqZ', 'h4eA0ohWfu'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, xKKRJ8VTFX4G1N1xGX.cs	High entropy of concatenated method names: 'D3dfiKS5Sp', 'rMefcvvbZK', 'SpffU7HpJA', 'Y3nfB1h5XH', 'NYFflbvhV9', 'DYCfHO444e', 'Ro7fNWUTix', 'B7nfvBrXKx', 'PPSf3hYOWA', 'SjmfJ9OJLq'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, ejlP3Oxj5VTYEvKO5r.cs	High entropy of concatenated method names: 'tZHDsgf5V', 'TqHL6fWn1', 'n4r5VkwwE', 'lcMunrfq2', 'RVYWKd0XW', 'lBY9qKXYe', 'Fx4iZHZBZDR5q6wj5U', 'hTgejTfqLGN7KQHyDI', 'MMDA6kDcf', 'DYEjtPCgx'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, TmNAWqstqFSpLbNpTE.cs	High entropy of concatenated method names: 'pyQQRlBiSp', 'E0vQe21bOq', 'McCQTqJuBH', 'yINTJekOsy', 'vY5TzynDHT', 'zAXQgYfYec', 'LR2QdtQDri', 'w0fQxrxcPL', 'mdVQZ4CeYY', 'xkXQkqk348'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, mFN8l0JlMCpR0cYUUm.cs	High entropy of concatenated method names: 'j0YbdHxUEM', 'yLAbZuoTT0', 'CmEbkWkI0T', 'VRqbRdmdvV', 'JjnbfoL9XJ', 'CW1bng2scv', 'DYFbTRNnyh', 'EpWANXpBum', 'MbQAvxSBmE', 'DPWA3vI2hG'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, kR0DFf3CmMYrZsqb6N.cs	High entropy of concatenated method names: 'PsbAmTPdsH', 'UL4AI1KolP', 'zZFAMYgyW4', 'Un6AhXQrVl', 'YZfAicwbo0', 'MkBAOySJCH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, mHKiENejJDcn6AxJbF.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'CMfx300hPc', 'nkTxJ5PJPg', 'ogsxz1YYcH', 'b1BZgjYLca', 'GFCZdvwC4f', 'C9EZx9j4Aj', 'JcAZZ1cK44', 'qgRnKrpWhesTAI9XFDB'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, yUquE6UMuMSijVwDGu.cs	High entropy of concatenated method names: 'ToString', 'wjeCp9TOsm', 'elwCIZR1jG', 'XLrCM6Or2t', 'B52ChAV4fs', 'Hc7COidv4y', 'r2mCqbdbRk', 'jrwCslyeRR', 'J30Co2JPTW', 'XT5C29RNwW'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, RgfDrXHKnC8jGFqB26.cs	High entropy of concatenated method names: 'UIirv4wQPb', 'W3JrJPpmbb', 'apDAg4jARg', 'rt9AdpI2cx', 'uOFrpJ8Ou2', 'UmZraxJtnF', 'jNqrF5QNWn', 'CVBriPBh2v', 'sQWrcW8ea3', 'VtorU1OQPw'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, T82yWMWSofDuDjyvkJ.cs	High entropy of concatenated method names: 'cH3eLV49E6', 'vTte5vCLHs', 'oYveVjVGRW', 'GTWeWhVeBq', 'hb4etnE68T', 'JZfeCR7GNq', 'g2nerLuvOO', 'bSyeAkjplI', 'RiiebyLH3g', 'yv2ejuWm7c'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, f9UIpU26JvmBTBSctL.cs	High entropy of concatenated method names: 'vfHQYG4MDd', 'lxLQ80Eh3u', 'QJwQDjcDQV', 'RsSQLbiuv5', 'XTdQ7qxngP', 'JvcQ5uSdXS', 'aL5QucoJJX', 'RgDQVmDUTR', 'aucQWNTHuO', 'qASQ96w7M7'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, G4wV8Gf6v2K5jjGjCT.cs	High entropy of concatenated method names: 'Dispose', 'EHid3gFA4w', 'JonxInLaGY', 'MbkXXgYQPF', 'fqYdJivPAb', 'ToJdzxPUPi', 'ProcessDialogKey', 'r2SxgR0DFf', 'pmMxdYrZsq', 'r6Nxx0FN8l'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, TeEwg8iN7vW6LLxRRW.cs	High entropy of concatenated method names: 'hOqt4bLcLD', 'qRutaW7Rmk', 'JvOtiQ1wuX', 'DcZtcWNJdC', 'fnmtIY1ulX', 'xZTtMtD2ll', 'WuCthA6ndI', 'CuCtOQdDiY', 'aRHtqNsKQm', 'zZBtsruW67'
Source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.4f1b6d8.0.raw.unpack, KVbeayhXmtlCZ27r6N.cs	High entropy of concatenated method names: 'i3FT6EgOZd', 'L0fTYU60io', 'O7ETDqlVyd', 'Yq1TLMDMZA', 'y5HT5YVhCu', 'VlKTu3RKje', 'H9lTWInGs8', 'DR2T9rw2JC', 'v12g6V4xk1vhjN1Ug52', 'bKrGdL4boFxp9Sou1KN'

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

File created: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 1780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 3210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 1780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 6560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 7560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 7690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 8690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 8D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: 9D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: AD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: BD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 23D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 58E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 68E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 6A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 7A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 7DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 8DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: 9DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: ADD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: C90000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A40000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: EE0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3944	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1133	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2252	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8186

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe TID: 936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6688	Thread sleep count: 3944 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4892	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 572	Thread sleep count: 235 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4988	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2328	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6920	Thread sleep count: 1133 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6920	Thread sleep count: 2252 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2676	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe TID: 5804	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1656	Thread sleep count: 1671 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1656	Thread sleep count: 8186 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98968s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98384s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -98063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -97029s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96918s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96812s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -96031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -95000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -94888s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -94781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -94672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -94563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5668	Thread sleep time: -94438s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97029
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94438

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior

Source: TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: MSBuild.exe, 00000008.00000002.2165476952.0000000006287000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3358366394.0000000005C82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 8_2_012670B0 CheckRemoteDebuggerPresent,

8_2_012670B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F7F008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 697008	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Queries volume information: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Queries volume information: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2160120971.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4548, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4548, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.454bfd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.50dafa0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.TgfQNrhQjjseHY.exe.45107b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UPDATED SSTATEMENT OF ACCOUNT.exe.509f780.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2160120971.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UPDATED SSTATEMENT OF ACCOUNT.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TgfQNrhQjjseHY.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	521 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UPDATED SSTATEMENT OF ACCOUNT.exe	37%	ReversingLabs
UPDATED SSTATEMENT OF ACCOUNT.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe	37%	ReversingLabs

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
ip-api.com	208.95.112.1	true	false	high
mail.tabcoeng.com	135.181.124.14	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://tempuri.org/x.xsd?MultiGames.Properties.Resources	UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr	false	unknown
http://mail.tabcoeng.com	MSBuild.exe, 00000008.00000002.2160120971.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://account.dyn.com/	UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	UPDATED SSTATEMENT OF ACCOUNT.exe, 00000000.00000002.2141321180.0000000003251000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.2160120971.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, TgfQNrhQjjseHY.exe, 00000009.00000002.2178810898.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/zuppao).	UPDATED SSTATEMENT OF ACCOUNT.exe, TgfQNrhQjjseHY.exe.0.dr	false	high
http://ip-api.com	MSBuild.exe, 00000008.00000002.2160120971.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000000D.00000002.3349333951.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
135.181.124.14	mail.tabcoeng.com	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428829
Start date and time:	2024-04-19 17:13:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UPDATED SSTATEMENT OF ACCOUNT.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@19/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 110 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.159.127.243, 52.165.165.26, 192.229.211.108, 20.3.187.198, 199.232.214.172, 52.165.164.15
Excluded domains from analysis (whitelisted): client.wns.windows.com, wns.notify.trafficmanager.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: UPDATED SSTATEMENT OF ACCOUNT.exe

Simulations

Behavior and APIs

Time	Type	Description
17:14:01	API Interceptor	1x Sleep call for process: UPDATED SSTATEMENT OF ACCOUNT.exe modified
17:14:03	API Interceptor	27x Sleep call for process: powershell.exe modified
17:14:04	Task Scheduler	Run new task: TgfQNrhQjjseHY path: C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
17:14:04	API Interceptor	197x Sleep call for process: MSBuild.exe modified
17:14:05	API Interceptor	1x Sleep call for process: TgfQNrhQjjseHY.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	DHL.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	ip-api.com/json
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/line/?fields=hosting
135.181.124.14	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	192.229.211.108
	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse	192.229.211.108
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://app.box.com/s/ktl5qtvf2us1megbgmjabwqaxcdy69b5	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://dt.r24dmp.de/	Get hash	malicious	Unknown	Browse	192.229.211.108
	s.exe	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	192.229.211.108
	http://bestprizerhere.life/	Get hash	malicious	Unknown	Browse	192.229.211.108
ip-api.com	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
mail.tabcoeng.com	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	135.181.124.14
bg.microsoft.map.fastly.net	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.210.172
	https://royaltattoo.in/js/kalexander@yourlawyer.com	Get hash	malicious	Phisher	Browse	199.232.214.172
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse	199.232.210.172
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	199.232.210.172
	s.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	199.232.214.172
	https://jll2.sharepoint.com/:f:/t/WorkplaceStrategy274/EqyxzpLxD8lEhSn1hXMNtKMBbmoik8-xeuIbHrYk7cgngA?e=5%3a2wyFQq&at=9&xsdata=MDV8MDJ8cGF0cmljaWEucmliZWlyb0Bub3ZvYmFuY28ucHR8NjlmMTdkMWU5YzBjNDFkN2UwZmIwOGRjNTNjN2YwZTV8MTAzMzgwNDgxOTNhNDI5OGFiZWEzNTk2YWU4OGIwNWV8MHwwfDYzODQ3NzM2NTQwMjI0OTQwNXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=T2RkZHdHdHpwUXkxSG5Kd2Noc1RHVUc3YVNLVE1sOWZUTXdVZitYYXh6Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	ServerInfo.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	135.181.124.14
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	136.243.216.235
	New Soft Update.exe	Get hash	malicious	Unknown	Browse	116.203.164.39
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	88.198.32.246
	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.242.86.246
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	144.79.65.41
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	168.119.31.114
	http://www.indeks.pt/	Get hash	malicious	Unknown	Browse	176.9.67.69
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	95.216.228.180
	https://00f82de.blob.core.windows.net/00f82de/1.html?4SdhQu6964HfYs43wfnwuulljn913CWVGBFRQHRPAHNP32199OVKO12176b14#14/43-6964/913-32199-12176	Get hash	malicious	Phisher	Browse	178.63.248.54
TUT-ASUS	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win64.Evo-gen.10533.31255.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	13w4NM6mPa.exe	Get hash	malicious	LummaC	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	173.222.162.64
	https://www.dropbox.com/l/scl/AADwcgxTbjuvzakz6kszZMzP6RXavhxhixQ	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	173.222.162.64
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	https://bestprizerhere.life/?u=3w8p605&o=pn1kfzq&t=pshtb_redirectUrl_body	Get hash	malicious	GRQ Scam	Browse	173.222.162.64
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	VnSRmWE631.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	xYUpeXwPkWEHXm4.exe	Get hash	malicious	AgentTesla	Browse	173.222.162.64
	nBBR7c5gR5.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	dwutTyDPzl2TBZV.exe	Get hash	malicious	AgentTesla	Browse	173.222.162.64

Process:	C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UPDATED SSTATEMENT OF ACCOUNT.exe.log

Download File

Process:	C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//8M0Uyus:lGLHxvCsIfA2KRHmOugw1s
MD5:	B11E25ABF5BF7766D7D7437596AFFED0
SHA1:	D673CFF28D1C21A672BFE165614629B2BB23DE93
SHA-256:	EE402CA8A7E7FA1F95CD644AFE756C8AF734E810797FD3E9C6762FCC2510F3F6
SHA-512:	D4C19BF1948BCF50899840F4B670ECF7510D65597054A89963D3155DB3869E65F2ABA2F6CE9C9E5F18890A65719E514E1D1EC6394EF99DF21E60F8220FA157C4
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caww4iwt.cup.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnlgrcyq.nbj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iyunuva1.4cb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mra1hua4.ssk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3nqfhd4.35i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0tc3v3q.egd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xsh0e31k.x3w.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzva54p5.5aw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpC678.tmp

Download File

Process:	C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.108633823969318
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLGxvn:cge7QYrFdOFzOzN33ODOiDdKrsuT2v
MD5:	311309CCB2289C24505110FE1A5449D0
SHA1:	01B0D0054BCDD85CC64FD8D1CE48AA2637062B8B
SHA-256:	E505613BD46CF611D0F5F79FCC1BC020F85309C7DD1FF281317402973E7B2186
SHA-512:	46AC33A1C232AAA711D21C8D28829EB22845CA8DFFD76907510122210EBAA6CD10F3CC072272EE85F6A8252CC990DDF18CBE84236470267AF5CA78D15DAC7077
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpD609.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.108633823969318
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLGxvn:cge7QYrFdOFzOzN33ODOiDdKrsuT2v
MD5:	311309CCB2289C24505110FE1A5449D0
SHA1:	01B0D0054BCDD85CC64FD8D1CE48AA2637062B8B
SHA-256:	E505613BD46CF611D0F5F79FCC1BC020F85309C7DD1FF281317402973E7B2186
SHA-512:	46AC33A1C232AAA711D21C8D28829EB22845CA8DFFD76907510122210EBAA6CD10F3CC072272EE85F6A8252CC990DDF18CBE84236470267AF5CA78D15DAC7077
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe

Download File

Process:	C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1031168
Entropy (8bit):	7.3124238980608
Encrypted:	false
SSDEEP:	24576:0f7y6rwJVCUv7MQehWtnEYVe5+2brHkfbwHo7m:xj/DMV4tebHYbwGm
MD5:	25E87D17F0C864FFDC217D43C82CC36C
SHA1:	AECD0FF1A25D22ACE6AB1C9650589CA916CABF3F
SHA-256:	37FDA41FDB04917E4C0DA2880B51BA07E959D53A31A93A9B47785A5BE8807BD7
SHA-512:	D1809508E78D48D398E48602A381C7E3BD45295A7B5BBD25403BF1EDD351B495CB85C4E2076099B97401E1D41DFD36670540D7431CF8C8C5CA574F96147C304D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p"f..............0.............".... ........@.. ....................... ............@.....................................O.......................................T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........N...W..........T...............................................^..}.....(.......(.....&..(........0..+.........,..{.......+....,...{....o........( ......0..=.........s!...}.....s"...}.....s#...}.....($.....{........s%...o&.....{.....s'...o(.....{.....o).....{....r...po.....{.... o....<s+...o,.....{.....o-.....{....r...po......{.... -....js%...o&.....{....r:..po*.....{.....K..s+...o,.....{.....o-.....{....rD..po......{.....o/.....{...........s0...o1.....{.....o2..

C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.3124238980608
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	UPDATED SSTATEMENT OF ACCOUNT.exe
File size:	1'031'168 bytes
MD5:	25e87d17f0c864ffdc217d43c82cc36c
SHA1:	aecd0ff1a25d22ace6ab1c9650589ca916cabf3f
SHA256:	37fda41fdb04917e4c0da2880b51ba07e959d53a31a93a9b47785a5be8807bd7
SHA512:	d1809508e78d48d398e48602a381c7e3bd45295a7b5bbd25403bf1edd351b495cb85c4e2076099b97401e1d41dfd36670540d7431cf8c8c5ca574f96147c304d
SSDEEP:	24576:0f7y6rwJVCUv7MQehWtnEYVe5+2brHkfbwHo7m:xj/DMV4tebHYbwGm
TLSH:	7225E23D0CBE1A3B9176D2AACFE88567F040D47B39126D7A94D383958346A9379C313E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p"f..............0.............".... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4fd022
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6622708E [Fri Apr 19 13:24:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfcfcf	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfe000	0x5f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x100000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfb30c	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfb028	0xfb200	1ddb7808f4082a882dedb84b7807dba3	False	0.7935384519661524	data	7.318017102591194	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xfe000	0x5f0	0x600	72ad7b120d9e542282d9119eb6a3d2c6	False	0.439453125	data	4.195996894871083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0xc	0x200	bcee61620cddc0ba58106cba59a9209c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xfe090	0x360	data			0.4363425925925926
RT_MANIFEST	0xfe400	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 17:14:00.019898891 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:00.022052050 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:00.285495996 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:04.222758055 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:04.339114904 CEST	80	49711	208.95.112.1	192.168.2.6
Apr 19, 2024 17:14:04.342086077 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:04.356827021 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:04.475250959 CEST	80	49711	208.95.112.1	192.168.2.6
Apr 19, 2024 17:14:04.519870996 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:05.480058908 CEST	49712	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:06.582465887 CEST	49712	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:07.591602087 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:07.709563017 CEST	80	49714	208.95.112.1	192.168.2.6
Apr 19, 2024 17:14:07.709660053 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:07.710444927 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:07.834146976 CEST	80	49714	208.95.112.1	192.168.2.6
Apr 19, 2024 17:14:07.879276037 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:08.355324030 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:08.503844976 CEST	49715	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:09.539673090 CEST	49715	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:09.676163912 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:09.707372904 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:09.987772942 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:11.302365065 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:11.302675962 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:11.551305056 CEST	49715	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:15.566844940 CEST	49715	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:21.602996111 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:21.604033947 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:21.609772921 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:21.609818935 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:21.609991074 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:21.615868092 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:21.615890026 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:21.755851030 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:21.756606102 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:21.948985100 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:21.949059963 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.147676945 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.147701979 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.148266077 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.148329973 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.150605917 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.150636911 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.150854111 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.196127892 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.587204933 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.587266922 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.587819099 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.587872028 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:22.587892056 CEST	443	49720	173.222.162.64	192.168.2.6
Apr 19, 2024 17:14:22.587943077 CEST	49720	443	192.168.2.6	173.222.162.64
Apr 19, 2024 17:14:23.566780090 CEST	49715	587	192.168.2.6	135.181.124.14
Apr 19, 2024 17:14:40.957426071 CEST	80	49714	208.95.112.1	192.168.2.6
Apr 19, 2024 17:14:40.957660913 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:58.504637003 CEST	49714	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:14:58.622822046 CEST	80	49714	208.95.112.1	192.168.2.6
Apr 19, 2024 17:15:39.770505905 CEST	49704	80	192.168.2.6	199.232.210.172
Apr 19, 2024 17:15:39.874782085 CEST	80	49704	199.232.210.172	192.168.2.6
Apr 19, 2024 17:15:39.874823093 CEST	80	49704	199.232.210.172	192.168.2.6
Apr 19, 2024 17:15:39.874918938 CEST	49704	80	192.168.2.6	199.232.210.172

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 17:14:04.097760916 CEST	63331	53	192.168.2.6	1.1.1.1
Apr 19, 2024 17:14:04.202157974 CEST	53	63331	1.1.1.1	192.168.2.6
Apr 19, 2024 17:14:05.348422050 CEST	52458	53	192.168.2.6	1.1.1.1
Apr 19, 2024 17:14:05.479351997 CEST	53	52458	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 17:14:04.097760916 CEST	192.168.2.6	1.1.1.1	0x2403	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:14:05.348422050 CEST	192.168.2.6	1.1.1.1	0x95e0	Standard query (0)	mail.tabcoeng.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 17:14:04.202157974 CEST	1.1.1.1	192.168.2.6	0x2403	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:14:05.479351997 CEST	1.1.1.1	192.168.2.6	0x95e0	No error (0)	mail.tabcoeng.com		135.181.124.14	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:14:20.796916008 CEST	1.1.1.1	192.168.2.6	0x573e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 17:14:20.796916008 CEST	1.1.1.1	192.168.2.6	0x573e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:14:21.364387989 CEST	1.1.1.1	192.168.2.6	0x6cbe	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:14:21.364387989 CEST	1.1.1.1	192.168.2.6	0x6cbe	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:15:21.811800957 CEST	1.1.1.1	192.168.2.6	0x7da0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:15:21.811800957 CEST	1.1.1.1	192.168.2.6	0x7da0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	208.95.112.1	80	3392	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 17:14:04.356827021 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 19, 2024 17:14:04.475250959 CEST	174	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 15:14:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	208.95.112.1	80	4548	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 17:14:07.710444927 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 19, 2024 17:14:07.834146976 CEST	174	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 15:14:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Target ID:	0
Start time:	17:14:01
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"
Imagebase:	0xd10000
File size:	1'031'168 bytes
MD5 hash:	25E87D17F0C864FFDC217D43C82CC36C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2142116748.000000000509F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UPDATED SSTATEMENT OF ACCOUNT.exe"
Imagebase:	0x410000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe"
Imagebase:	0x410000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpC678.tmp"
Imagebase:	0x4b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:14:02
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xbd0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2160120971.0000000002F33000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2156023579.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2160120971.0000000002F5F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:14:04
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\TgfQNrhQjjseHY.exe
Imagebase:	0x160000
File size:	1'031'168 bytes
MD5 hash:	25E87D17F0C864FFDC217D43C82CC36C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2180777401.0000000004510000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:14:04
Start date:	19/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:14:06
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TgfQNrhQjjseHY" /XML "C:\Users\user\AppData\Local\Temp\tmpD609.tmp"
Imagebase:	0x4b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:14:06
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:14:06
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x520000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3349333951.0000000002A9E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.3349333951.0000000002A72000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	273
Total number of Limit Nodes:	16

Executed Functions

Function 0186D0A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0186D136
GetCurrentThread.KERNEL32 ref: 0186D173
GetCurrentProcess.KERNEL32 ref: 0186D1B0
GetCurrentThreadId.KERNEL32 ref: 0186D209

Strings

<3Z, xrefs: 0186D0D4

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: Current$ProcessThread
String ID: <3Z
API String ID: 2063062207-3925590025
Opcode ID: 57de9eb9d3d57087ebafbce64d8456d5cae07ab91bd45230a4d800858801097f
Instruction ID: 108ca3129468e166c17a251531a1a3f801011af60fc8a8e32a81657f33561c16
Opcode Fuzzy Hash: 57de9eb9d3d57087ebafbce64d8456d5cae07ab91bd45230a4d800858801097f
Instruction Fuzzy Hash: EE5175B0A01649CFDB14DFAAD548BDEBBF1EF88310F208559E109A7360DB346984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0186D0B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0186D136
GetCurrentThread.KERNEL32 ref: 0186D173
GetCurrentProcess.KERNEL32 ref: 0186D1B0
GetCurrentThreadId.KERNEL32 ref: 0186D209

Strings

<3Z, xrefs: 0186D0D4

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: Current$ProcessThread
String ID: <3Z
API String ID: 2063062207-3925590025
Opcode ID: 221e20f79a3b5a37706bcc22cc858be664e010d4be35cb3d0ea791befb7b41a9
Instruction ID: f6d8af04e96cf4d6fadacb94a000848beed30f12af6baf40cc81c141ca827c10
Opcode Fuzzy Hash: 221e20f79a3b5a37706bcc22cc858be664e010d4be35cb3d0ea791befb7b41a9
Instruction Fuzzy Hash: 325176B0A01649CFDB04DFAAD548B9EFBF5EF88310F208559E109B7360DB74A984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01789530 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01789766

Strings

<3Z, xrefs: 0178956B
<3Z, xrefs: 0178959A

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: CreateProcess
String ID: <3Z$<3Z
API String ID: 963392458-2007775535
Opcode ID: e42725109e1b4a14fe24d74ce1a53a6234309900902c07ff921c410f1ded7ee3
Instruction ID: cc8889b453e31a8597b9cdb9c868e0ac0744198ab838f1cf0dba2fdf989a86d4
Opcode Fuzzy Hash: e42725109e1b4a14fe24d74ce1a53a6234309900902c07ff921c410f1ded7ee3
Instruction Fuzzy Hash: 0D914B71D00219DFEB20DF69C841BEDFBB2BF88318F1481A9E909A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0178952F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 01789766

Strings

<3Z, xrefs: 0178956B
<3Z, xrefs: 0178959A

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: CreateProcess
String ID: <3Z$<3Z
API String ID: 963392458-2007775535
Opcode ID: 7bdc394f69278b900f106edcb19b350f89790ac64ed81350093b687e3f053862
Instruction ID: 2ca73e9496e2fc989cc1d4d832e4d5442d38da3b1acaf24f818b26e684e02ca1
Opcode Fuzzy Hash: 7bdc394f69278b900f106edcb19b350f89790ac64ed81350093b687e3f053862
Instruction Fuzzy Hash: E0914A71D40259DFEB20DF68C841BEDFBB2BF88318F1481A9E909A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0186AE30 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0186B086

Strings

<3Z, xrefs: 0186B03F

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: HandleModule
String ID: <3Z
API String ID: 4139908857-3925590025
Opcode ID: 98a4ecbff755a5598a3320ece542512bffb56d09b2f8f0ed47abf47b33c0ef4e
Instruction ID: 7979a159c8b1fb157b16ce56f4565bb46f7b083a6ad7b1162095591874f7059c
Opcode Fuzzy Hash: 98a4ecbff755a5598a3320ece542512bffb56d09b2f8f0ed47abf47b33c0ef4e
Instruction Fuzzy Hash: 8E7149B0A00B058FDB28DF2AD45475ABBF5FF88704F00892ED44AE7A50DB75EA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0186590C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Strings

<3Z, xrefs: 0186594C

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: Create
String ID: <3Z
API String ID: 2289755597-3925590025
Opcode ID: 0ee65d15a22c8f00f51df1a85000b3362e3eab5d156ca3bcb592db71bcf52d2c
Instruction ID: b5c5c8a8b150434a57be408efcc8eba1a60d002476db9eedb6a1813bc6e9c564
Opcode Fuzzy Hash: 0ee65d15a22c8f00f51df1a85000b3362e3eab5d156ca3bcb592db71bcf52d2c
Instruction Fuzzy Hash: 3F41CFB1C0071DCBDB24CFA9C884BCDBBB5BF49714F20815AD408AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0186449C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Strings

<3Z, xrefs: 0186594C

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: Create
String ID: <3Z
API String ID: 2289755597-3925590025
Opcode ID: e29cfec77b60b13fdca7062ff672806528edd3d6ade7d4a4568351b55ea26714
Instruction ID: 3ae0c1775aa4ff4a31f7263acbbbb9b9b2bf4653b5416628ddfd215dd0d8a272
Opcode Fuzzy Hash: e29cfec77b60b13fdca7062ff672806528edd3d6ade7d4a4568351b55ea26714
Instruction Fuzzy Hash: D141C0B0C0071DCFDB24CFAAC884B9EBBB5BF49714F20816AD508AB255DB756A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017892A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01789338

Strings

<3Z, xrefs: 017892C7

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: <3Z
API String ID: 3559483778-3925590025
Opcode ID: 654c87f48d8008e5fa995da789bb4591523141d126319877277c1eaa21463ab6
Instruction ID: 12a22cfd65cdaacdb6c909a11b113175262d743674bb286e44e01c4be6c536f8
Opcode Fuzzy Hash: 654c87f48d8008e5fa995da789bb4591523141d126319877277c1eaa21463ab6
Instruction Fuzzy Hash: 83212A759003499FDB10DFA9C881BEEBBF5FF88314F108429E918A7240D7789540CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 017892A7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 01789338

Strings

<3Z, xrefs: 017892C7

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: <3Z
API String ID: 3559483778-3925590025
Opcode ID: b5a72f6585a7b7627f71a43f7b77e5cf9cca19ffb4b5ead0baa589e5c1ab9f36
Instruction ID: 38f69817a3302078157a2667d732e8bbd3e86fde7c7ce40b75ed91795c05c2a8
Opcode Fuzzy Hash: b5a72f6585a7b7627f71a43f7b77e5cf9cca19ffb4b5ead0baa589e5c1ab9f36
Instruction Fuzzy Hash: DC2127759003499FDF10DFA9C881BEEBBF1FF88314F10842AE919A7240C7789945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01789108 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0178918E

Strings

<3Z, xrefs: 0178912C

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: ContextThreadWow64
String ID: <3Z
API String ID: 983334009-3925590025
Opcode ID: 4bda878bfaf8ae18ed13ed19ee57014c778bfff3681c39ae5389a8c15562c234
Instruction ID: a5e0ed05d6e01d28f71d6b9c2c7a64479807301ed2d3abb5275319f46ad87b84
Opcode Fuzzy Hash: 4bda878bfaf8ae18ed13ed19ee57014c778bfff3681c39ae5389a8c15562c234
Instruction Fuzzy Hash: 3C213771D043098FDB10DFAAC4857EEFBF4EF88624F14842AD619A7241CB799945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0186D2F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0186D387

Strings

<3Z, xrefs: 0186D31F

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: DuplicateHandle
String ID: <3Z
API String ID: 3793708945-3925590025
Opcode ID: 1024e7580f75fe2dbaf820e7371e3eef385287b70b8353b47b53436bfe628e7c
Instruction ID: 78832bebf4c5269d52a1fe469a11725005ad7bd6f4679268c4bb42383e343266
Opcode Fuzzy Hash: 1024e7580f75fe2dbaf820e7371e3eef385287b70b8353b47b53436bfe628e7c
Instruction Fuzzy Hash: 2521E5B5900249DFDB10CFAAD984AEEBBF5EB48320F14855AE914A7310D378A954CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01789110 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0178918E

Strings

<3Z, xrefs: 0178912C

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: ContextThreadWow64
String ID: <3Z
API String ID: 983334009-3925590025
Opcode ID: b48f240bb4fd01521c31a413044e72c0df99aa20922e530aa09afa40fcd3b8d4
Instruction ID: 5bdcf2ecd1a7ad9abc7580e3c215507b12b82fef3fa1a542e649c2a8b4d130fb
Opcode Fuzzy Hash: b48f240bb4fd01521c31a413044e72c0df99aa20922e530aa09afa40fcd3b8d4
Instruction Fuzzy Hash: A6210771D043098FDB10DFAAC8857AEFBF4EF88624F14842AD519A7240DB78A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01789398 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 01789418

Strings

<3Z, xrefs: 017893B7

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: MemoryProcessRead
String ID: <3Z
API String ID: 1726664587-3925590025
Opcode ID: 0911fef0d1698ddd12da6998357d4d271230a5d8adc1641dfb97560d633ea13f
Instruction ID: 5a697db7ba54b7b03e3e028ef2a42a8bae2307013ecc231936e55896448699c4
Opcode Fuzzy Hash: 0911fef0d1698ddd12da6998357d4d271230a5d8adc1641dfb97560d633ea13f
Instruction Fuzzy Hash: 602128719003499FDB10DFAAC881AEEFBF5FF88320F10842AE518A7240C7799500CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01789397 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 01789418

Strings

<3Z, xrefs: 017893B7

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: MemoryProcessRead
String ID: <3Z
API String ID: 1726664587-3925590025
Opcode ID: 0bb8b7d69316af02c2b15f163dd2d3517063b6d9bd6858fb72725391dcfa5b3c
Instruction ID: 682cb40525df2d8ae3bab164ca841ce2012f24883c9d8e0294e9efc5fd1ffc97
Opcode Fuzzy Hash: 0bb8b7d69316af02c2b15f163dd2d3517063b6d9bd6858fb72725391dcfa5b3c
Instruction Fuzzy Hash: 9A212875D003499FDB10DFAAC881AEEFBF1FF88320F10842AE519A7240C7799501CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0186D300 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0186D387

Strings

<3Z, xrefs: 0186D31F

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: DuplicateHandle
String ID: <3Z
API String ID: 3793708945-3925590025
Opcode ID: 59e5b6aef635420603d60cb77f13dccab8f2b2270437a0e5e5ad6f0f81224459
Instruction ID: 2deb14e23d85802b954adb27af5221195373bc6d39098711ac03eab1404c05e1
Opcode Fuzzy Hash: 59e5b6aef635420603d60cb77f13dccab8f2b2270437a0e5e5ad6f0f81224459
Instruction Fuzzy Hash: 8E21E6B5900248DFDB10CF9AD984ADEFFF8EB48320F14845AE914A7310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0186B019 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0186B086

Strings

<3Z, xrefs: 0186B03F

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: HandleModule
String ID: <3Z
API String ID: 4139908857-3925590025
Opcode ID: b164b9cce8a8e8ecf06d3856da1bd0b25507c1f2a3d80778b6b639cdb43d80cf
Instruction ID: 36b9f568f8de8a4f5c26bc395c1334694dd592fcf9837c9397ea6c7e90617bcc
Opcode Fuzzy Hash: b164b9cce8a8e8ecf06d3856da1bd0b25507c1f2a3d80778b6b639cdb43d80cf
Instruction Fuzzy Hash: 572145B5D00749CFCB20CFAAD4046DEFBF4AB89718F14855AC529A7211C375664ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0186A870 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0186B101,00000800,00000000,00000000), ref: 0186B312

Strings

<3Z, xrefs: 0186B2C7

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: LibraryLoad
String ID: <3Z
API String ID: 1029625771-3925590025
Opcode ID: fd31164560b4db90f5e222808ce27055a71f3017a036a5164e7c2966536326e4
Instruction ID: 0a0cd25454c93c76157d04c8287020b075444e383152584fc4f0029cbf675d4d
Opcode Fuzzy Hash: fd31164560b4db90f5e222808ce27055a71f3017a036a5164e7c2966536326e4
Instruction Fuzzy Hash: 461117B69003498FDB10CF9AD444A9EFBF8EB88314F10845AD915A7300C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0186B2A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0186B101,00000800,00000000,00000000), ref: 0186B312

Strings

<3Z, xrefs: 0186B2C7

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: LibraryLoad
String ID: <3Z
API String ID: 1029625771-3925590025
Opcode ID: 48f940e090eb187ffd8f633f3e3dd7955fe9aeff5fd5423857a73e42e8ab5333
Instruction ID: 1c83f6b68d3f0cf23078145f6be627786cecbbad11c11a370595e85e654a1575
Opcode Fuzzy Hash: 48f940e090eb187ffd8f633f3e3dd7955fe9aeff5fd5423857a73e42e8ab5333
Instruction Fuzzy Hash: 171126B6D042498FDB10CFAAC444ADEFBF8EB88724F10845AD919A7300C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017891E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01789256

Strings

<3Z, xrefs: 017891FF

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: AllocVirtual
String ID: <3Z
API String ID: 4275171209-3925590025
Opcode ID: c824a0fc05775e337fde22e8a2c7980514148301b3ca7ac9b273b7cc7b5030da
Instruction ID: 6b486ebf610dbbd21c38a2cbb8873f14736e59e1b8a706e6c9eb33e053428e62
Opcode Fuzzy Hash: c824a0fc05775e337fde22e8a2c7980514148301b3ca7ac9b273b7cc7b5030da
Instruction Fuzzy Hash: 971156719042499FDB10DFAAC844BEEFFF5EF88720F108419E619A7250C775A500CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 017891E7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 01789256

Strings

<3Z, xrefs: 017891FF

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: AllocVirtual
String ID: <3Z
API String ID: 4275171209-3925590025
Opcode ID: 15a81b7eaa832a8cd9d395b1a2b08a754d694db4c36ee34baf61913ff1b419d2
Instruction ID: 4460baa4cc5780d851ca9f40e106cbf97fa71d291a91c90a2f018384f8f5b7bc
Opcode Fuzzy Hash: 15a81b7eaa832a8cd9d395b1a2b08a754d694db4c36ee34baf61913ff1b419d2
Instruction Fuzzy Hash: B81144759042499FDB10DFAAC844AEEBFF5AF88320F148419E519A7250C7759500CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01789058 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 017890C2

Strings

<3Z, xrefs: 01789077

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: ResumeThread
String ID: <3Z
API String ID: 947044025-3925590025
Opcode ID: ad1137d23c73136756901679dcc4c0288c7b25fab91524aa6cf3dd9f329d9824
Instruction ID: 2bd273527bbc2ebab3f6baf2751273c1319e23df8624ca6716721087ee74712b
Opcode Fuzzy Hash: ad1137d23c73136756901679dcc4c0288c7b25fab91524aa6cf3dd9f329d9824
Instruction Fuzzy Hash: 0A1158719003498FDB20DFAAC4457EEFFF4EF88724F20881AD619A7240CB79A505CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01789060 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 017890C2

Strings

<3Z, xrefs: 01789077

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: ResumeThread
String ID: <3Z
API String ID: 947044025-3925590025
Opcode ID: 57e7851e74bb2ffb50d9ef0b20e4bb882e4ce855a5d1394d6aff500c91d4674b
Instruction ID: 8221e9632471f5c5cebf00d8b42038cf3233413ab9efbee14674204f7a731094
Opcode Fuzzy Hash: 57e7851e74bb2ffb50d9ef0b20e4bb882e4ce855a5d1394d6aff500c91d4674b
Instruction Fuzzy Hash: EA116A71D003498FDB10DFAAC4457EEFBF4EF88724F108419D519A7240CB79A500CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0178905F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 017890C2

Strings

<3Z, xrefs: 01789077

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: ResumeThread
String ID: <3Z
API String ID: 947044025-3925590025
Opcode ID: f9aa89edb3da7653e82a1676eb49e121af53c1778dc674893e2bfd676685de19
Instruction ID: 9f4960d3eda5ec74f2181f91dd487d489c6d2d9545728d879a5c546c2cc8d796
Opcode Fuzzy Hash: f9aa89edb3da7653e82a1676eb49e121af53c1778dc674893e2bfd676685de19
Instruction Fuzzy Hash: 0B115571D002498FDB20DFAAC4457EEFBF4EF88724F24885AD519A7240CB79A905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0186B020 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0186B086

Strings

<3Z, xrefs: 0186B03F

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: HandleModule
String ID: <3Z
API String ID: 4139908857-3925590025
Opcode ID: 741e7ac5d076775b9ac51579ba18863da8508afd5e47d0ea589dc34349c58694
Instruction ID: 40a293a051e429df9eacdb69283c0f7c6c575b2df53dbc9147a65396ec3a42eb
Opcode Fuzzy Hash: 741e7ac5d076775b9ac51579ba18863da8508afd5e47d0ea589dc34349c58694
Instruction Fuzzy Hash: 881102B5D003498FDB10CF9AC444A9EFBF8AB88724F10845AD528A7210C379A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0178ACD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0178DF6D

Strings

<3Z, xrefs: 0178DF2A

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID: MessagePost
String ID: <3Z
API String ID: 410705778-3925590025
Opcode ID: fe6f9fb2702298ce2481c0136265a500122ca866274da6e83117ca59ce2d149e
Instruction ID: 67e4128ca31c28a0d0a130f703fe5c4ebdda337bb3bb720d5ce138067ad1d428
Opcode Fuzzy Hash: fe6f9fb2702298ce2481c0136265a500122ca866274da6e83117ca59ce2d149e
Instruction Fuzzy Hash: 911103B5804349DFDB20DF9AD844BDEFBF8EB48720F10845AE918A7240C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138242115.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14dd000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc984597d670767dadc36ca76f6f6919d4d7790aa3f0812cbe18de264bd2af95
Instruction ID: 34eae1174505d6c5571ab42c2e299af94f20373499fe579eaa7d1edc333db372
Opcode Fuzzy Hash: dc984597d670767dadc36ca76f6f6919d4d7790aa3f0812cbe18de264bd2af95
Instruction Fuzzy Hash: 9A210672900240EFDF05DF54D9E0B27BFA5FB88718F24C56AD9050B2A6C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138242115.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14dd000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8827ae680acf94dcadcf39c14ed110b287168168216aac58a5a8e8d531bcb24
Instruction ID: 12475c97446645b453fe7e11127a8e45cdfbbab49976fe00ac845b4f859bea17
Opcode Fuzzy Hash: b8827ae680acf94dcadcf39c14ed110b287168168216aac58a5a8e8d531bcb24
Instruction Fuzzy Hash: C821F472900204DFDF05DF94D9C0B56BFA5FB88324F24C17ED9090B2A6C336E456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138341810.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf260496a8ab8c0a6c04de059f9b0dd991fb5ce68526982e87f012baa095e21
Instruction ID: f0d35f05c9187d15e96cd6017cc036735bc99f0a568b0e811fe74781bb0bb1ed
Opcode Fuzzy Hash: 7cf260496a8ab8c0a6c04de059f9b0dd991fb5ce68526982e87f012baa095e21
Instruction Fuzzy Hash: 572125B1904200DFDB15DF54D988B16BFE1FB88319F28C56ED90A0B366C336D407CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138341810.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f3c6c8b2c450ca6e0f2866a7021e0dc1b932f3f8ee7d234fe3d93fdcb042e6
Instruction ID: 5e967e628aa3fa8577a430f86520607cd94fe9dc79a1e553bcb878756eca49e1
Opcode Fuzzy Hash: 64f3c6c8b2c450ca6e0f2866a7021e0dc1b932f3f8ee7d234fe3d93fdcb042e6
Instruction Fuzzy Hash: C9213771904200EFDB01DF94D9C8B16BBE1FB88325F20C56ED9094B3A2C336D406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 014ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138341810.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ea3c3ff1eef16fbe9255a0a0e9710a1d85e7eefad0c0ac6ecc9db8d91979d4
Instruction ID: 669540cfa0ffb0144c71c4a12b87b8f2326cd4fcc40190f943a978629f4cab04
Opcode Fuzzy Hash: 11ea3c3ff1eef16fbe9255a0a0e9710a1d85e7eefad0c0ac6ecc9db8d91979d4
Instruction Fuzzy Hash: 702183755093808FDB02CF64D594716BFB1EB46214F28C5DBD8498B267C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 014DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138242115.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14dd000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction ID: 10daf33f1ae2897d4088254945c3bcd26b2d76d4958ae81ac50c5095dabffaac
Opcode Fuzzy Hash: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction Fuzzy Hash: BC11CD72804280DFDF12CF44D9C0B56BF61FB84224F2482AAD8090B266C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138242115.00000000014DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14dd000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction ID: 774744ea602dfb24424c4ac0d7734d68e4ffcff9687f7f1cc9744757788b2cba
Opcode Fuzzy Hash: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction Fuzzy Hash: B111DF72804280CFCF12CF54D9D0B16BF71FB84314F24C6AAD8090B266C33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138341810.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e3e11dd54d086b93e848213dee2e5cd9da70134201e791e4ff5700e7437990
Instruction ID: ea77272cd17985ab895f28f12d3dee208de626a68345f9917454d6c007eddbea
Opcode Fuzzy Hash: 57e3e11dd54d086b93e848213dee2e5cd9da70134201e791e4ff5700e7437990
Instruction Fuzzy Hash: 1911BB75904280DFDB02CF54C5C4B16BBA1FB84224F24C6AAD8494B3A6C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0178F8E0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88c503c5f12e6a95f85ecd62777f22d89ce2bb7ada8da4ceaffcd0ff745cd26
Instruction ID: ae317ed22c8c5830638ba1d74cb8b5fa820a5e5d3b142883a99c00a958ee516f
Opcode Fuzzy Hash: f88c503c5f12e6a95f85ecd62777f22d89ce2bb7ada8da4ceaffcd0ff745cd26
Instruction Fuzzy Hash: EBE1CD317416059FEB19EF79C464BAEBBF6AF89300F1484ADC245DB290DB35DA01CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01787190 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a850c2f286680aa03949fa1e57bb52146908537abf16cae4dd925b408278e0b
Instruction ID: d37bf56a37afa2cf6036093fb3d0a48ed3f6b76f4c34c9c254d40171744b5513
Opcode Fuzzy Hash: 3a850c2f286680aa03949fa1e57bb52146908537abf16cae4dd925b408278e0b
Instruction Fuzzy Hash: 47E13974E042598FDB14DFA9D580AAEFBB2FF89300F248169D415AB356D730AD81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017864E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792cd40c575e38e4cb7b8e158835b372870c4f6fe435cf8aff2b1b60036a57f0
Instruction ID: 01ec9de50bfd5d3fc91b33444ce6c8318dbf0035cce5597af86f625322c68995
Opcode Fuzzy Hash: 792cd40c575e38e4cb7b8e158835b372870c4f6fe435cf8aff2b1b60036a57f0
Instruction Fuzzy Hash: 83E11C74E002599FDB14DFA8D580AAEFBB2FF88304F248169E515AB356D730AD41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01786920 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de212d4f22466d9b2864cc253253d5b934f401f13c11618ee9840dd9fe58dd9e
Instruction ID: 2641b8b73a1c27f05816a3b742a17e9dddb7c7f6e5dd6a0b60520acf995a1484
Opcode Fuzzy Hash: de212d4f22466d9b2864cc253253d5b934f401f13c11618ee9840dd9fe58dd9e
Instruction Fuzzy Hash: 1CE13B74E002599FDB14DFA9C580AAEFBB2FF89304F248169E405AB356D730AD81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01788838 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5a6931b06b21065dc36d5d9057a90a120158f788339db9eb771827007394c0
Instruction ID: 573f5e02e69fc805e37fc4b839f356c211a7b5103362868609c62d5ec48e0eb8
Opcode Fuzzy Hash: 5d5a6931b06b21065dc36d5d9057a90a120158f788339db9eb771827007394c0
Instruction Fuzzy Hash: C9E11874E002598FDB14DFA9D580AAEFBB2FF88304F648169D415AB356D730AD81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01786D58 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4de1be1f02af6813cfdea86b3d8d5b104579294f7842c8a73faf42ea5373f8
Instruction ID: 5c95df8441334829a6c9a8650cca1b760b76e40975d1be5d414568d00ed65c60
Opcode Fuzzy Hash: bd4de1be1f02af6813cfdea86b3d8d5b104579294f7842c8a73faf42ea5373f8
Instruction Fuzzy Hash: 85E11B74E042598FDB14DFA8D580AAEFBB2FF88304F248169E515AB356D730AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0186DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140326402.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b91918835d034ca9912f12e0063c8ea796319e693d4b829073a3011c12b4eb5
Instruction ID: adec6e4d82007abffecd8e7115230e7396254153e314392ed2f19d659cc6b1f6
Opcode Fuzzy Hash: 3b91918835d034ca9912f12e0063c8ea796319e693d4b829073a3011c12b4eb5
Instruction Fuzzy Hash: 9FA16E32A0020A8FCF19DFB9D89059EBBB6FF84300B15456AE905EB265DB71DA55CF80

Uniqueness

Uniqueness Score: -1.00%

Function 017859E0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb4f878a63ec80102eaf2cbadd96de219ab5408552ebea19585c64e35cd11ce
Instruction ID: 1424912796e27127a04685b8adeec369594d05ceaca8c8c1c262356ba3db3f49
Opcode Fuzzy Hash: 8cb4f878a63ec80102eaf2cbadd96de219ab5408552ebea19585c64e35cd11ce
Instruction Fuzzy Hash: F151B274E49209CFCB04DF9AD5849EEFBF6AF89310F1490A6E419B7211D7309A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0178D0F4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2139037276.0000000001780000.00000040.00000800.00020000.00000000.sdmp, Offset: 01780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1780000_UPDATED SSTATEMENT OF ACCOUNT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394fda043172e0974bea634d829ff52138c087e03fa6d7d76012db9853ffacab
Instruction ID: 2fbb093a6b2cc174fd3645cc5cbb0818c693ecb64c9f7fb0576a5adf0781249c
Opcode Fuzzy Hash: 394fda043172e0974bea634d829ff52138c087e03fa6d7d76012db9853ffacab
Instruction Fuzzy Hash: D8D05E20A8D2849BC7211BD8E00C4F8FBBADF4B025B0520E2D15EAB493C2614626868A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 3392, Parent PID: 6516COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 06900040 Relevance: 2.8, Instructions: 2806COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5298d309c023a8025c1b92ceade6d0afdd18576bbecfbc897394c1e78088c203
Instruction ID: b677a489628bbfa21bdd6b4cd6514048dedddade6db52b72617e1bca5a408c1d
Opcode Fuzzy Hash: 5298d309c023a8025c1b92ceade6d0afdd18576bbecfbc897394c1e78088c203
Instruction Fuzzy Hash: 2863D631D10B5A8EDB51EF68C884A99F7B1FF99300F15D69AE44877121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 069034F8 Relevance: 2.2, Instructions: 2228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724c68ebb0c37d8961649553e18e9e1db30efd7d20d711a1882e82441e196a0c
Instruction ID: 76d6acf0ce945831680488b545c817299b87e850d7dd37626df68c5ec74c5330
Opcode Fuzzy Hash: 724c68ebb0c37d8961649553e18e9e1db30efd7d20d711a1882e82441e196a0c
Instruction Fuzzy Hash: 8B330D31D1071ACEDB11EF68C8805ADF7B5FF99300F25C69AE458A7251EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06900007 Relevance: 1.9, Instructions: 1949COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc2df8b424e318b51bbc6541e8ffc3d4bbfb6716ea1c73065ce3d80c3067e78
Instruction ID: 3056e38bcdd12a5f6ee5efdd6eab02165ac991d38e8e68fa1ff60963d367a1b2
Opcode Fuzzy Hash: 3bc2df8b424e318b51bbc6541e8ffc3d4bbfb6716ea1c73065ce3d80c3067e78
Instruction Fuzzy Hash: 8123E631D10B5A8EDB51EF68C8806A9F7B1FF99310F15D69AE44877121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 012670B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01267127

Memory Dump Source

Source File: 00000008.00000002.2158641479.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1260000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: b0aaec27b79b5f814be686e6ade5acaabd76c91e939f314e139c1c5aefe5fe2c
Instruction ID: 83411119bb66199c7f4b942dd56ee7556953a283d4ca6f364ab674d21b4d4ee9
Opcode Fuzzy Hash: b0aaec27b79b5f814be686e6ade5acaabd76c91e939f314e139c1c5aefe5fe2c
Instruction Fuzzy Hash: 102137B1800259CFDB14CF9AD884BEEFBF4EF49324F14845AE559A3250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06905AF8 Relevance: 1.0, Instructions: 1022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f338b57b019d71d3f0b5d1307866bf23978ff7b6f0514bbf10714f4149a99e1
Instruction ID: 4e394b9554e2fc059d6685ebadb1c4f0250687e67faece63fde28628feefddd3
Opcode Fuzzy Hash: 6f338b57b019d71d3f0b5d1307866bf23978ff7b6f0514bbf10714f4149a99e1
Instruction Fuzzy Hash: 4B924734E00205CFEB64DB68C584A5DB7F6EB89314F6584AAD409EB7A1DB75EC81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06909D60 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08afcdf7fa5ffb3db9b2e7a8b33ac3b5796f8b7123943d8c699e289fd4b2281c
Instruction ID: 9657c2ce7a2255bccd7f6f5b7249c28dbcf9983066d467c38e6b590096062bfe
Opcode Fuzzy Hash: 08afcdf7fa5ffb3db9b2e7a8b33ac3b5796f8b7123943d8c699e289fd4b2281c
Instruction Fuzzy Hash: 8F62AF34B102098FEB54DB68D594AADB7F6FF88314F248429E416DB796DB35EC81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06908940 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7423222cf3a97f6a63065de52e8f89916839895e9dc106f720f60536e29e059
Instruction ID: dacd1e010e2ed3a7f5f700b15cf53dc6d9d79a27a85eb2566f08a829edf1e6b9
Opcode Fuzzy Hash: e7423222cf3a97f6a63065de52e8f89916839895e9dc106f720f60536e29e059
Instruction Fuzzy Hash: 8C12F071F002159FEF64DBA4C99066EB7BAEB84364F208429E955DB781DB34EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0690E9A7 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055a442f75ef090713b9b8004915a16c99ca3b316dd0223a183bc6e6939f1ab6
Instruction ID: 630828cb777b007da1a07a29f8581225a9d2ce5a13ad6a4895df3af76f713770
Opcode Fuzzy Hash: 055a442f75ef090713b9b8004915a16c99ca3b316dd0223a183bc6e6939f1ab6
Instruction Fuzzy Hash: FB226F70E1010A8FFFA4DB69D4907AEB7BAFB89310F308926E415D7785DA35DC818B91

Uniqueness

Uniqueness Score: -1.00%

Function 06906808 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb51cf05e8f9f9f709f49b9e999cd6d94d3c2b21363af3a35fc567c5ea22468e
Instruction ID: e757995328b7ec55baa20ebe56d74ee922370b9a8a716d39c76db41526ae6bae
Opcode Fuzzy Hash: eb51cf05e8f9f9f709f49b9e999cd6d94d3c2b21363af3a35fc567c5ea22468e
Instruction Fuzzy Hash: CD323031E1065ACFDB14EFB5C85059DB7B6BFD9300F20C6AAD50AA7254EB70AD81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0690B4F0 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f6ffcc6cb3ba829950ea7f831c52c562c1736dbd50109ccb8d62fb28c49e41
Instruction ID: a29950808d20078686193c1c6cb7a5957478cc8c2b0d79e7baf8e3e8c0ca107a
Opcode Fuzzy Hash: c0f6ffcc6cb3ba829950ea7f831c52c562c1736dbd50109ccb8d62fb28c49e41
Instruction Fuzzy Hash: 6A029030B0021A8FEB54DB69D494B6EB7E6FF88314F248528D416DB798DB31EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 012670A8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 01267127

Memory Dump Source

Source File: 00000008.00000002.2158641479.0000000001260000.00000040.00000800.00020000.00000000.sdmp, Offset: 01260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1260000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2335695ec551a10a2f35f1081289c1f0938e4aafd8eee3d05877bdf5c2af3cd2
Instruction ID: 19b71485fd0bfb1969eaf8bee7dde9bc355d4f4966f7eb2a688c17c235462812
Opcode Fuzzy Hash: 2335695ec551a10a2f35f1081289c1f0938e4aafd8eee3d05877bdf5c2af3cd2
Instruction Fuzzy Hash: 1121487180025ACFDB14CF9AD884BEEFBF4AF48324F24846AE455A3650C738A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0690EDC8 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c06c8b5459dd7ae9bf69f9a50a9f8e16d20211a55f8f55615eb491287ef6d62
Instruction ID: 85df1608e7883168cb9036d7734382510585bdbd878907336e0db0dc90732839
Opcode Fuzzy Hash: 6c06c8b5459dd7ae9bf69f9a50a9f8e16d20211a55f8f55615eb491287ef6d62
Instruction Fuzzy Hash: 0F029370E0020ACFEBB4DB68D4946ADB7BAFB49350F24892AD815DB781D770DD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0690E440 Relevance: .4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d712c0351fec5b041b00a50d64f6926985da7ef938772983d9c08caf31dae0d
Instruction ID: 7e9e17e345163c5228897eeea6ad5383fd95bc6538c39090dca69a767934f2c8
Opcode Fuzzy Hash: 2d712c0351fec5b041b00a50d64f6926985da7ef938772983d9c08caf31dae0d
Instruction Fuzzy Hash: 30E18F30E1020A8FEF64DB69D4546AEB7B6FF88300F208929D516EB795EB70DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06907640 Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33608e3baab1b8345c3685a84099a86139d6d26f7d58003f71aacdb49aae4a36
Instruction ID: e96e7dc297957ebd1d38abbc865b8a56c809c6e91b74b72902f64d6d8e86e0b0
Opcode Fuzzy Hash: 33608e3baab1b8345c3685a84099a86139d6d26f7d58003f71aacdb49aae4a36
Instruction Fuzzy Hash: C8917030B1024A8FEB54DBB9D4547AEB7B6EF85350F248429D40ADF385EB74EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0690C8C8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced1a2e6382f053569a827c93745cd7608326ec4d1bea72de6e52d9a7e1e50d3
Instruction ID: cb13ef91c702f8f21e5870b97a65ea855feabf1b087209173ee2f7938e79e71c
Opcode Fuzzy Hash: ced1a2e6382f053569a827c93745cd7608326ec4d1bea72de6e52d9a7e1e50d3
Instruction Fuzzy Hash: A1915430B0065A9FEB54DB79D8507AE73B6FF85340F108569C419EB788EB709C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06909558 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d806154ddfc8da257413b525b746d74e609cfada9106f5d133bd69c667fe480c
Instruction ID: 0fce3ebf1885235cbc5862bf679b5b9a2cef8d17612b148b3e5730c32896bdc1
Opcode Fuzzy Hash: d806154ddfc8da257413b525b746d74e609cfada9106f5d133bd69c667fe480c
Instruction Fuzzy Hash: 7E61D172F001224FDF549A7EC88055FBADBAFC4220B244439E80EDB3A5DE65EC0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 06907960 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c2b0fd29bffec226368d00314801f58f170d3c039b636ee6be66406295f214
Instruction ID: 76f842da1f67415badbac9a050716d31f1890513f30f425095a7407645b5ac64
Opcode Fuzzy Hash: 37c2b0fd29bffec226368d00314801f58f170d3c039b636ee6be66406295f214
Instruction Fuzzy Hash: F8914D30E1025A8FEF64DFA8C840B9DB7B1FF89314F208599D549AB291DB70AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06909548 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f067c06246ee488ba39855d0b9d9f5c61e36252d477e27862ccd8cfe5ac8a0
Instruction ID: af5297eea74d66703a7938435d9f69a7f6067dd8a14e9aa33aebe1e08dc32792
Opcode Fuzzy Hash: d0f067c06246ee488ba39855d0b9d9f5c61e36252d477e27862ccd8cfe5ac8a0
Instruction Fuzzy Hash: 0751F372F001224FDB11DA7EC88455FBADBAFC4220B25407AE80EDB361DEA5ED0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06907978 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3da622443aa6e22d20cf2d76f96f98062252dd604975f9e13854bba6558b4cd
Instruction ID: 521d5df9c7993370419e025f7e8acba1ab65d8c1501c0cca20b4180ba617c58c
Opcode Fuzzy Hash: c3da622443aa6e22d20cf2d76f96f98062252dd604975f9e13854bba6558b4cd
Instruction Fuzzy Hash: E1912E30E1061A8FDF64DFA8C880B9DB7B1FF89314F208599D549AB385DB70A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06907F10 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15568295284adf2adf41e2c3efdbde2bba37ecd817d84869d943edd1a0263dca
Instruction ID: 7c1e046d587f8e6d4841b716ea1f6e0d222a84005aa8a23678cae0d342d42507
Opcode Fuzzy Hash: 15568295284adf2adf41e2c3efdbde2bba37ecd817d84869d943edd1a0263dca
Instruction Fuzzy Hash: 57619C70F002199FEF949BA5C8147AEBBF6FF88340F20842AE116EB395DB754C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 0690C8BE Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277710eebf0a038ec6bdf609e4ec18bde5295ada529d9d395dcd791a46847b1d
Instruction ID: 2e49917b36c4a562d31fbb834a2acaaa26f6939e134915901e7644af9c259f6f
Opcode Fuzzy Hash: 277710eebf0a038ec6bdf609e4ec18bde5295ada529d9d395dcd791a46847b1d
Instruction Fuzzy Hash: 26514130B0155A9FEB54DB78D8A0BAE73F6FF88640F148569C41ADB798EB70DC018B91

Uniqueness

Uniqueness Score: -1.00%

Function 069087B8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c3f3667b352446874009c502da2eaa921abbf5914619e34c4f4462d676c6c3
Instruction ID: c7ca5191b8f5dc04a917f15feb159db2481429f6e60cf616b51a685a1a7b7f49
Opcode Fuzzy Hash: 01c3f3667b352446874009c502da2eaa921abbf5914619e34c4f4462d676c6c3
Instruction Fuzzy Hash: D9417531F006099FDF70CE99D9806AFF7BAFB85310F20492AD656D7680D730A9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06907F00 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0db5d5678ad4a9a2e5ecda7b40b94628eafd43a0ff12e6b0743da6d1802f098
Instruction ID: 3e646aefbf5a69825f64e97db2feef511dd65b8d6cab55ceb265a79995e6a0fc
Opcode Fuzzy Hash: f0db5d5678ad4a9a2e5ecda7b40b94628eafd43a0ff12e6b0743da6d1802f098
Instruction Fuzzy Hash: 9A418E70B102199FEB549BA5C814BAEBBF7FF88340F208529E116EB395DB749C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06905980 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8433ee75c3fdb66c0a99bb7eac6abfabe1e7352910dc3d936811af70a9ce7ffb
Instruction ID: 1e80d96a7439be145e480823de9f3a3cdf9e08e07be51499085626885c784517
Opcode Fuzzy Hash: 8433ee75c3fdb66c0a99bb7eac6abfabe1e7352910dc3d936811af70a9ce7ffb
Instruction Fuzzy Hash: 4E31AF30B002068FEB58AB35C55466F7BA7AB89750F64486CD416DB385EE35CC41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06905830 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad91a91a9b1d6b01f6b44d3628399ceb8a5552c36bbbbb346a007e7e3067e81e
Instruction ID: 166ae8c826d19b2454ee85b79a1e4dc7f42f9c0a4bec4adabe4441092210d1ce
Opcode Fuzzy Hash: ad91a91a9b1d6b01f6b44d3628399ceb8a5552c36bbbbb346a007e7e3067e81e
Instruction Fuzzy Hash: 3E315C70E1020A9FDB19DF64C99469EB7B6AF89310F208529E816E7780DB30AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06905840 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7be8f079f2dae598d695be543746cb52734a7acd43e555cd845069b8dde0e3b
Instruction ID: a2055ccd6edb5e9f8d2d8322afd2927611f199f4c689af0c91451d118e0ce615
Opcode Fuzzy Hash: b7be8f079f2dae598d695be543746cb52734a7acd43e555cd845069b8dde0e3b
Instruction Fuzzy Hash: 07315C30E1020A9FDB19DF64C99469EB7F6BF89300F208529E816E7790DB70AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06907248 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55a6f73b1c7c2d71d6a5d1dd13ac113bad7cfbc8c29ea8ac08ab97e4dd5efdd
Instruction ID: 3f03d0fe2a8876d94f31fc22ea90d3bbe38e8eadc0fd898da641c055fbdd80d1
Opcode Fuzzy Hash: e55a6f73b1c7c2d71d6a5d1dd13ac113bad7cfbc8c29ea8ac08ab97e4dd5efdd
Instruction Fuzzy Hash: 0F21B175F012199FEB40DFA8D940AAEB7F5AB48220F104029E915EB380E734EC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 06907258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d100283c18b64a31e727c739ccec9cb370b66e2ffedc2c482dea0d3f8d5f31
Instruction ID: 76769dd53e6a29a868f32588796be2bde2a3559534420f47704b1e955b8c65eb
Opcode Fuzzy Hash: 64d100283c18b64a31e727c739ccec9cb370b66e2ffedc2c482dea0d3f8d5f31
Instruction Fuzzy Hash: 21217C75F112199FEB50DFA9E950AAEB7F5AB48260F144029E915EB380E734E8418B90

Uniqueness

Uniqueness Score: -1.00%

Function 069075A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3724a22a38e071f99311e000dddc032479e723f5f8ddef7e494c6a3127a359f1
Instruction ID: e6cb6d7d485b532607761b72943e36e46be2191f2f5920cf6c810bce971d8ca3
Opcode Fuzzy Hash: 3724a22a38e071f99311e000dddc032479e723f5f8ddef7e494c6a3127a359f1
Instruction Fuzzy Hash: F11192317001151FEB6696BD981476BB7DADBC9620F24843AE10ACB791EA65EC0243E2

Uniqueness

Uniqueness Score: -1.00%

Function 06907368 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a272955248b6674aef1c998a544c66dfcb0b909f40a2e534fa62898c7e9f76
Instruction ID: 68dd1ba9c68508483858c5c1eeed8b22661af9077aeb2a2f1924ad321bd5b433
Opcode Fuzzy Hash: a0a272955248b6674aef1c998a544c66dfcb0b909f40a2e534fa62898c7e9f76
Instruction Fuzzy Hash: 7211A532B101694FEB94A6A8D8146AE73EBABC8211B144539C906EB384DE74DC0187D1

Uniqueness

Uniqueness Score: -1.00%

Function 06907358 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac41564ae1524ca01304ea1dc0796a592028bd9217a296f8c2e5d47281fc4c0
Instruction ID: 608e71d82b63ae4fc3fbe3c3a89f51bf6fe5b97aaf13cfa688687c3c67b89c69
Opcode Fuzzy Hash: fac41564ae1524ca01304ea1dc0796a592028bd9217a296f8c2e5d47281fc4c0
Instruction Fuzzy Hash: 1A012D36B111690FEF98A5A99C106EF76AFDBC8611F20413AD406DB784EE709C0647D1

Uniqueness

Uniqueness Score: -1.00%

Function 06907021 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f327fbfba4939acd3dedc183388cfe079539f890aeb99bdd1b01b83d9a8dbf22
Instruction ID: 93f9a118a2e3408f1b3acda54940373909340ddd1258c3e6a4d41d409fa9230a
Opcode Fuzzy Hash: f327fbfba4939acd3dedc183388cfe079539f890aeb99bdd1b01b83d9a8dbf22
Instruction Fuzzy Hash: 6521F4B5D01259AFDB00CF9AD884BCEFBB4FB48724F10822AE518A7240C3756544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06907028 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e333ca5db6b9a1a0ef88fa97b194d89d5c64b311d64b3a017fa4911936cebb6
Instruction ID: 9a15d736706972cd41cbe0b647f8de27f43fae5fb705649b090c6b8b24946388
Opcode Fuzzy Hash: 8e333ca5db6b9a1a0ef88fa97b194d89d5c64b311d64b3a017fa4911936cebb6
Instruction Fuzzy Hash: 1411D3B1D01259AFDB00CF9AD884ACEFBB4FB48724F10822AE918A7640C3756554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069075B0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b273e19c66038e9209e5d09d7dcfdd01f9183a85fe09cf9d658480c2063b05
Instruction ID: a44fd98e66cc0c99dab94cb357bcb08736f358f5e6de63585f712f0c803df561
Opcode Fuzzy Hash: 91b273e19c66038e9209e5d09d7dcfdd01f9183a85fe09cf9d658480c2063b05
Instruction Fuzzy Hash: 95016D31B001154FEB6596BE945472BB2DADBC9720F34883AE50BCB784EE61EC4243A2

Uniqueness

Uniqueness Score: -1.00%

Function 0690DA78 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f180033a5e3159c793f6ccb0c9552544fdea92c4dcf50c88b5e945f21192ae
Instruction ID: b7e2744a52f76b749dc5600f6f311ef5a9841185e58db1c121db48e0ea1e98d9
Opcode Fuzzy Hash: b0f180033a5e3159c793f6ccb0c9552544fdea92c4dcf50c88b5e945f21192ae
Instruction Fuzzy Hash: 0B01A230B041195FEB61EABCD56072A77DAEF89720F308839E50BC7794EA21EC068781

Uniqueness

Uniqueness Score: -1.00%

Function 0690DA88 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc8c332ce74f749e63c28f64423ef4652d3715d90aed23546d5e2a5fe9d91b2
Instruction ID: 5fc5144107eeb239d07e1771ef1d4d0e32d7c327584b91e19f8b0094cd012053
Opcode Fuzzy Hash: ebc8c332ce74f749e63c28f64423ef4652d3715d90aed23546d5e2a5fe9d91b2
Instruction Fuzzy Hash: 88014434B105195FEB65EABDD56471B77DAEB89720F308838E10BC7794EE21DC068781

Uniqueness

Uniqueness Score: -1.00%

Function 0690BA37 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6eda253df5d7c95e61da779ef35451a4cec9ee622eaaf0a2e58c5ef01355393
Instruction ID: 8aa13c6bb029d76dbfac2df2c9ba4f2cbe0d0d4c15c370ccc97c2a34b44cc799
Opcode Fuzzy Hash: f6eda253df5d7c95e61da779ef35451a4cec9ee622eaaf0a2e58c5ef01355393
Instruction Fuzzy Hash: E0F05832A04218CFFB648A54E9942A877F9EB413A0F384862D800939D8E3329E82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06909BE0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e880a5427cd0d2349821d1444feaa0fb36dd13c0270bf351b1e2d5be1e9cb73
Instruction ID: d2801b7cf848963986ec0fc2180a44b13a2d693093b43795b78bef96b10ba328
Opcode Fuzzy Hash: 6e880a5427cd0d2349821d1444feaa0fb36dd13c0270bf351b1e2d5be1e9cb73
Instruction Fuzzy Hash: B2E06870E102087FEF50DE70C881B5A3BADCB42104F2044A1E40CCB683E536CA018340

Uniqueness

Uniqueness Score: -1.00%

Function 06907DF9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2166170733.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6900000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0a894ee9b8e9bda76913976d3422d52655494caf0d9b18a52d5b382cb7580e
Instruction ID: ca9d51b2cc5c5e5c2b9de054e9d8ac76eb94eb339762896de5b50b2224031e5d
Opcode Fuzzy Hash: fb0a894ee9b8e9bda76913976d3422d52655494caf0d9b18a52d5b382cb7580e
Instruction Fuzzy Hash: CEF0FE70A11129DFDB24DF90E859BADBB76FF88710F204519E402E7694CB741C41CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TgfQNrhQjjseHY.exePID: 4460, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	220
Total number of Limit Nodes:	14

Executed Functions

Function 00AAD0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00AAD136
GetCurrentThread.KERNEL32 ref: 00AAD173
GetCurrentProcess.KERNEL32 ref: 00AAD1B0
GetCurrentThreadId.KERNEL32 ref: 00AAD209

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dc4baa565b8a18f69428c70d80471cd1c9bbe232cfaba64d8b18a52f73c40f01
Instruction ID: cdb328e1e95763fbea31ba3bc45859e0180123352e0e5bb0efe8c528ed2fa7e1
Opcode Fuzzy Hash: dc4baa565b8a18f69428c70d80471cd1c9bbe232cfaba64d8b18a52f73c40f01
Instruction Fuzzy Hash: 255165B0900249CFDB14CFAAD548BEEBFF1EF89314F20859AE009A72A1DB345944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00AAD0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00AAD136
GetCurrentThread.KERNEL32 ref: 00AAD173
GetCurrentProcess.KERNEL32 ref: 00AAD1B0
GetCurrentThreadId.KERNEL32 ref: 00AAD209

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d089300c17f7e1a19b4401d9ef9c4ea0a0433f983101f0ca98406c7593248f23
Instruction ID: 8211e6140bb5843bf61e91c1eb813cb9fe21f5de3120c802fa3c55a7e48576d0
Opcode Fuzzy Hash: d089300c17f7e1a19b4401d9ef9c4ea0a0433f983101f0ca98406c7593248f23
Instruction Fuzzy Hash: 805154B0D00249DFDB14CFAAD548B9EBBF1EF89314F208559E409A73A0DB749944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 023D9524 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 023D9766

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 26a262838fd556b5de4b8f0c07d3ccdb47b429373ec222f9cc52de38351c827a
Instruction ID: af4c4cc525fd55dc798058e650397a51eb4648deb191372a2ea36124c5a998e9
Opcode Fuzzy Hash: 26a262838fd556b5de4b8f0c07d3ccdb47b429373ec222f9cc52de38351c827a
Instruction Fuzzy Hash: 2CA16C72D00259DFEF20CF68D841BEEBBB2BF48714F0481A9E809A7240DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 023D9530 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 023D9766

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8c24b48bccfceba13096e5c746226d52b7f6306209d2a39e15f116a59afafea3
Instruction ID: 5ad9fcea7572a85a5631474fa13e5e9b2fb23f42aad3a55093a19c3c8fb19bc6
Opcode Fuzzy Hash: 8c24b48bccfceba13096e5c746226d52b7f6306209d2a39e15f116a59afafea3
Instruction Fuzzy Hash: ED915C72D00259CFEF20DF69D841BEEBBB2BF48714F1481A9E809A7240DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00AAAE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AAB086

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 21a617f700693d8630f6393458960e3fa900e3283ce6a358d7e29697357f8f20
Instruction ID: 3496cdd38eb5857a407ed03ccf1bd411fc2b2b393423c18be9344825d318d44e
Opcode Fuzzy Hash: 21a617f700693d8630f6393458960e3fa900e3283ce6a358d7e29697357f8f20
Instruction Fuzzy Hash: 57716770A00B058FDB24DF2AD45079ABBF1FF89700F108A2EE44AD7A90D775E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AA590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00AA59C9

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4c932eabfa6a398ab07fde23b1d6eb26951948ca41d0fc229c752b0f016db07c
Instruction ID: 5c3210437537b04d506d02171424058d39f370f54ae0fd12e37f8dcd34669db6
Opcode Fuzzy Hash: 4c932eabfa6a398ab07fde23b1d6eb26951948ca41d0fc229c752b0f016db07c
Instruction Fuzzy Hash: 2B41E0B0C0075DCBEB24CFAAC884BDEBBB5BF89714F20815AD408AB255DB756946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00AA449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00AA59C9

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d321f086d010babd0200c1bc306c348cab22e300967615828831037bab164264
Instruction ID: c1aba1675817031badaae41acd50c76eca146e5bc761863a2130241f420ad3fc
Opcode Fuzzy Hash: d321f086d010babd0200c1bc306c348cab22e300967615828831037bab164264
Instruction Fuzzy Hash: C041DFB0D0071DCBEB24CFAAC884B8EBBB5BF49714F20816AD408AB255DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 023D92A0 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 023D9338

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7bd7c010d5989e8393d07642f770729f11ed701b581c88dc260a57e5ed231721
Instruction ID: f626e256567a4bce43cfb28315a3caca808d42ae1cd8a57456babddd110922e6
Opcode Fuzzy Hash: 7bd7c010d5989e8393d07642f770729f11ed701b581c88dc260a57e5ed231721
Instruction Fuzzy Hash: F1213772D003499FDB10CFAAC885BDEBBF5FF48714F108429E919A7240D7789955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 023D92A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 023D9338

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 340741a57116f23dd4f903b50219d9fc7d3a480bbf8e6b7582f13fa0367c3839
Instruction ID: abedabea0bdc6e21346faecc1d863a175b23883ff04e6d6b025f9c938cdb54f1
Opcode Fuzzy Hash: 340741a57116f23dd4f903b50219d9fc7d3a480bbf8e6b7582f13fa0367c3839
Instruction Fuzzy Hash: 63212776900349DFDB10CFAAC885BDEBBF5FF88324F108429E918A7240D7789950CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAD2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AAD387

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d0bd5e283b1fc49e6a97935bf353ba589710d82e5bfc68d018a295b1a0d952e4
Instruction ID: f40f7160610eb1416e9091c22f97662349d8b642249039cb6107415f9ac44e90
Opcode Fuzzy Hash: d0bd5e283b1fc49e6a97935bf353ba589710d82e5bfc68d018a295b1a0d952e4
Instruction Fuzzy Hash: 922103B5D00248DFDB10CFAAD885AEEBFF4EB48320F14801AE958A3250C375A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023D9390 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 023D9418

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cd591d7694f855a9aa304f28fc0df7e210503ae173867e312a616617e2b21dec
Instruction ID: 22dcd6d285cd36fa54031471f9af27557e8da8be9ae859cfb8119facb2763f88
Opcode Fuzzy Hash: cd591d7694f855a9aa304f28fc0df7e210503ae173867e312a616617e2b21dec
Instruction Fuzzy Hash: FF214875D002499FDB10CFAAC881BEEBBF5FF88320F10842AE918A7241C7399500CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 023D9108 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 023D918E

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 30378b09338ce875166f7042cf125b9d810c3763813d539be3cb4feaff1a7001
Instruction ID: 6c27f1042e1a46c922f46f6825651427104fabdefe076a252ac1cec7cac2c7e3
Opcode Fuzzy Hash: 30378b09338ce875166f7042cf125b9d810c3763813d539be3cb4feaff1a7001
Instruction Fuzzy Hash: 28216872D002098FDB10CFAAC485BEEBBF4EF88324F14842ED419A7241CB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 023D9398 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 023D9418

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7bd68823d169e2565ad91f5881b788908ba5c9ce45309b3e149563906a34a6bb
Instruction ID: 6412e0c102eb158451d050b80b70ee43c8cc0b2b5f76322f95f0bcdc4a4c1f11
Opcode Fuzzy Hash: 7bd68823d169e2565ad91f5881b788908ba5c9ce45309b3e149563906a34a6bb
Instruction Fuzzy Hash: AD212871D003499FDB10CFAAC881BEEBBF5FF88720F108429E518A7241D779A500CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 023D9110 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 023D918E

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 10298bad13d65ece7d670c81b3bc6197199d6846c3814ce7c5652f1730d39172
Instruction ID: 6e129a20e9cce11401460eeb50f96d8f4e01e0f199a0301eb519cd293e7e7b1a
Opcode Fuzzy Hash: 10298bad13d65ece7d670c81b3bc6197199d6846c3814ce7c5652f1730d39172
Instruction Fuzzy Hash: 32214971D003098FDB10CFAAC4857EEBBF4EF88724F148429D519A7241DB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAD300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00AAD387

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac3b71e184e6094832e6c8a8e410ba48b04dcf9fe15b9c5115c2b62c4e648fe2
Instruction ID: 73d22abc0cd74c70b9bf4e4e4ac48a95c628cb9e86082c8ad706e72e31c0b1f6
Opcode Fuzzy Hash: ac3b71e184e6094832e6c8a8e410ba48b04dcf9fe15b9c5115c2b62c4e648fe2
Instruction Fuzzy Hash: 6721E3B5900248DFDB10CF9AD884ADEBBF4EB48720F14841AE918A7250D375A950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023D91E1 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 023D9256

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b5aec955bb078ba90697367a741f803634b45eda302b666fdbf5f90540c00786
Instruction ID: 765923890823d50d3da0ddea3346541f3e09dfa260f71d18b5c93596cbfe7c6d
Opcode Fuzzy Hash: b5aec955bb078ba90697367a741f803634b45eda302b666fdbf5f90540c00786
Instruction Fuzzy Hash: AB11567290024D9FDB10DFAAC845BEFBFF5EF88720F148819E519A7250CB75A500CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AAB101,00000800,00000000,00000000), ref: 00AAB312

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22eb811e615291deac9483b8aa0c5a42d6b128c5d1598773f270763129f335a6
Instruction ID: f400992cbb88c493b5c8382573ea9cf604b65544841def0592b96de2b3b44945
Opcode Fuzzy Hash: 22eb811e615291deac9483b8aa0c5a42d6b128c5d1598773f270763129f335a6
Instruction Fuzzy Hash: 271114B6C003499FDB10CF9AD444BDEFBF4EB88720F10842AE919A7241C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB2A1 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00AAB101,00000800,00000000,00000000), ref: 00AAB312

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 976d3b55aef2448a49d55e1013ba69e5061fb819e9fd47e1589ab0aae5973948
Instruction ID: 92fc3d1affe305fe77525e2c1be88f8ade1b77725df7c2e46c0932f4b3bc2951
Opcode Fuzzy Hash: 976d3b55aef2448a49d55e1013ba69e5061fb819e9fd47e1589ab0aae5973948
Instruction Fuzzy Hash: D81114B6C006498FDB10CFAAD444BDEFBF4EF88720F10842AD919A7251C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023D91E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 023D9256

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 35b5a141e58b1c4e8a42cacac499bf0337c630da7424f1df24347e0f3524a6c6
Instruction ID: 291f2d5c4dd6534302b4dd339c599c2ca8f4cff3102d750fd4ae1bb54a990e03
Opcode Fuzzy Hash: 35b5a141e58b1c4e8a42cacac499bf0337c630da7424f1df24347e0f3524a6c6
Instruction Fuzzy Hash: 8E11237690024D9FDB10DFAAC845BEFBBF5EF88720F148819E519A7250CB75A940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 023D9058 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 023D90C2

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 19d81592bd1003a6cd6844982a9bcca8b403691fc42dd5a7a2dacee10e9b2534
Instruction ID: 067fd7093274c8476d3b28ab2b4a07e5e5bc0eba96bfccea85f231d96a73a019
Opcode Fuzzy Hash: 19d81592bd1003a6cd6844982a9bcca8b403691fc42dd5a7a2dacee10e9b2534
Instruction Fuzzy Hash: 87114671D002498FDB20DFAAD4457EEBFF4EF88720F148459D519A7240CB759540CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB019 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AAB086

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 36a4df31c08969eeb461584252dab24d84996d44cfe623ff4b78d8ae2d5c2ac5
Instruction ID: 839c8898252822dd45efb05e381cfa20b165ff899f70dfa21bd0088a230234eb
Opcode Fuzzy Hash: 36a4df31c08969eeb461584252dab24d84996d44cfe623ff4b78d8ae2d5c2ac5
Instruction Fuzzy Hash: 371123B1C006498FCB20CFAAD444BDEFBF0AF89720F14845AD468A7241C379A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 023D9060 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 023D90C2

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c965a97abf64b48dcf53db6e252391b3fd95048896b954099864cd98b63b2f68
Instruction ID: 3620a557f76849ed4b8bbb6771f095c570748400b57d1bce14414a7389c5e2e2
Opcode Fuzzy Hash: c965a97abf64b48dcf53db6e252391b3fd95048896b954099864cd98b63b2f68
Instruction Fuzzy Hash: DE115571D003498FDB20DFAAD8457EEFBF4EF88720F248819D519A7240CB79A900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AAB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00AAB086

Memory Dump Source

Source File: 00000009.00000002.2176880213.0000000000AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_aa0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bed588ce1e47be48725e7981ce0d4e67174c598f4df6e9d350cc7f25ff993b6d
Instruction ID: 7b9e66dd5286dc3477670ffd0a90d3a76f7eaf9e18968bfaed81e847bfaad528
Opcode Fuzzy Hash: bed588ce1e47be48725e7981ce0d4e67174c598f4df6e9d350cc7f25ff993b6d
Instruction Fuzzy Hash: E811D2B5C007498FDB20CF9AC444BDFFBF4AB89720F10845AD429A7651D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023DADBC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 023DD435

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f68c3cbf483794982457147c62daf6d814777bbe4e0e5cbc8c7bfee0a1fbb01d
Instruction ID: e7e59287b4fb7847b4438e6fa6b054ec94acade34d210f0c8b7541b1bbfeb3e3
Opcode Fuzzy Hash: f68c3cbf483794982457147c62daf6d814777bbe4e0e5cbc8c7bfee0a1fbb01d
Instruction Fuzzy Hash: 0411F2B690034DDFDB10CF9AD545BDEBBF8EB48720F10845AE918A7601C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023DD3D1 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 023DD435

Memory Dump Source

Source File: 00000009.00000002.2177666388.00000000023D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_23d0000_TgfQNrhQjjseHY.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 69553979768cf8938a25782455e08de591848ce6a09c075dd2e87bc3849210e4
Instruction ID: 07377d70e4d2ad7a0d75416ae35837d4e7354df6791ffd9725ce9f02d929dcec
Opcode Fuzzy Hash: 69553979768cf8938a25782455e08de591848ce6a09c075dd2e87bc3849210e4
Instruction Fuzzy Hash: 261103B6800249DFDB10CF9AD485BDEBFF8EB48324F108459E958A7711C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176519764.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a4d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cea50aeb1058911e46e46ad04be695fd979f97922b37e52c77a61c3638efee
Instruction ID: 3f443b75811a3e8a451582d35199dd29b313f47eb0eab6a4c7871eac58a739a7
Opcode Fuzzy Hash: 49cea50aeb1058911e46e46ad04be695fd979f97922b37e52c77a61c3638efee
Instruction Fuzzy Hash: 61210376600240EFDB05DF14D9C0B26BFA5FBC8718F24C56DE9090B256C736D856CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176519764.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a4d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fb4df45d6401e11b8f812c4f28da3c9ba9a0377c1028278a4c798dc06ffe59
Instruction ID: ef00e0e3cf6acecd29997671b1f2cb341e00ef438b186925c4d18a9d13852752
Opcode Fuzzy Hash: 92fb4df45d6401e11b8f812c4f28da3c9ba9a0377c1028278a4c798dc06ffe59
Instruction Fuzzy Hash: 2121257A500204EFDB05DF14D9C0B16BFA5FBD8324F24C56DE9090B256C33AE856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176604000.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a5d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ff45f88f4e564144da0c975d4433c5d66bac8c9ab53cf782e33296af81056c
Instruction ID: 1fde6a0aa040f590e1fbf21d15ef95fea7eb9b97c9e1d2017813cfaf50ca5534
Opcode Fuzzy Hash: e3ff45f88f4e564144da0c975d4433c5d66bac8c9ab53cf782e33296af81056c
Instruction Fuzzy Hash: 6C210471504304EFDB25DF14D9C0B2ABBA5FB88715F24C6ADED094B292C376D84ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176604000.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a5d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764f12acd54f957f4ea47de2a508b0cc208bee04087612638f687a8ebed5068a
Instruction ID: b821f7172e2559ad37874d08c91f9ab4647fca83fda4bd603aa123300631f65f
Opcode Fuzzy Hash: 764f12acd54f957f4ea47de2a508b0cc208bee04087612638f687a8ebed5068a
Instruction Fuzzy Hash: 71212271604200EFDB24DF14D9C0B16BBA1FB88315F20C56DDC0A4B286C33AD80BCA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A5D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176604000.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a5d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cb41cfd52a714312ed67e3bfbb70b37dcac97cd522b7c189e49a891507c15c
Instruction ID: adc1622ae3b60a88cf297f1ba3ee60cd3c32eb2a8e1a9920ae19730436b1cb18
Opcode Fuzzy Hash: f5cb41cfd52a714312ed67e3bfbb70b37dcac97cd522b7c189e49a891507c15c
Instruction Fuzzy Hash: B22192755093C08FDB12CF20D990715BF71FB46314F28C5DAD8498B6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176519764.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a4d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction ID: 76ef6cbbe14d554ecc3993d310b9bc7e5ce1bedad47dca699119133b4823f2ea
Opcode Fuzzy Hash: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction Fuzzy Hash: 3711D376504280CFCB15CF14D5C4B16BF71FBD4314F24C6A9D8494B656C33AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176519764.0000000000A4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a4d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction ID: d089b6db101ce3864af0113175d6dd82e22bf8c55e2218a106fca0c1e6c2985c
Opcode Fuzzy Hash: 7c1c52f64057ba31c7b3472a60d7ef901d747df3ca643598d73882777f3d56ec
Instruction Fuzzy Hash: 1911D376504280DFDB15CF14D5C4B16BF71FBD4324F24C6A9D8090B656C33AE856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2176604000.0000000000A5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a5d000_TgfQNrhQjjseHY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e3e11dd54d086b93e848213dee2e5cd9da70134201e791e4ff5700e7437990
Instruction ID: 240362fc4ca4421339069d4d045249ecace8683a4e984d366d9a7996a50b7ce8
Opcode Fuzzy Hash: 57e3e11dd54d086b93e848213dee2e5cd9da70134201e791e4ff5700e7437990
Instruction Fuzzy Hash: C011BB75504280DFCB11CF10C5C0B19BBA1FB84314F24C6ADDC494B296C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 4548, Parent PID: 4460COMMON

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 00C9FE70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00C9FF31

Memory Dump Source

Source File: 0000000D.00000002.3346787906.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c90000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: dd0e4b9f965cf062b0bbf742f13ace134e94b52f9e9491fdaa9842953a09d64c
Instruction ID: 4353b7e25fc32db51ed3c522e0b1b3dbed5a34d36c593fbc6993010eaaa6826a
Opcode Fuzzy Hash: dd0e4b9f965cf062b0bbf742f13ace134e94b52f9e9491fdaa9842953a09d64c
Instruction Fuzzy Hash: AC413AB5900309CFCB14CF99C448AAABBF5FF88314F24C89CE519AB321D774A841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C970A8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00C97127

Memory Dump Source

Source File: 0000000D.00000002.3346787906.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c90000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 47db3875a1b814691b3b4df5f6be55c5bb1864e50de0fcd4d1b04bf32929bde2
Instruction ID: 92ccf66fbe87c6e8b0004ae0d25ea4c0a78c992e6c701588773253cb00b398fb
Opcode Fuzzy Hash: 47db3875a1b814691b3b4df5f6be55c5bb1864e50de0fcd4d1b04bf32929bde2
Instruction Fuzzy Hash: 33213971811259CFDB10DF9AD844BEEBBF4EF48320F14855AE459A3251C778AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C970B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00C97127

Memory Dump Source

Source File: 0000000D.00000002.3346787906.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c90000_MSBuild.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 70c042fece0fa17b57673612895d31ffb685d45cdf76dd447a17ce9e808e2645
Instruction ID: f744513dd79ffce176f9f5e2522646195f12fd939f6f2f6f69d43ac6cb44f173
Opcode Fuzzy Hash: 70c042fece0fa17b57673612895d31ffb685d45cdf76dd447a17ce9e808e2645
Instruction Fuzzy Hash: 7A2137B2801259CFDB10CF9AD884BEEFBF4EF48320F14855AE459A3650D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3346295930.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02516a5faab48e6a1c6741813596f7e68a7b5d9e43e019510cb265cdb4c4bd8
Instruction ID: 7939b5817d8a67ccfe7f02d07aee145ec68fa63359f49773a2753fa5b179377d
Opcode Fuzzy Hash: a02516a5faab48e6a1c6741813596f7e68a7b5d9e43e019510cb265cdb4c4bd8
Instruction Fuzzy Hash: B5210471604344DFDB14EF14D9C4B16BBA5FB88714F24C5ADE90A4B286C37AD847CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3346295930.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c4d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf526e77f84be1a295a0361ddce0a73bf795fe2257dcc6ffb7c62f88686d2385
Instruction ID: 447d916b928eb711440c9e477b20a9a6970e9d34d644fece9cab63183ab6be88
Opcode Fuzzy Hash: bf526e77f84be1a295a0361ddce0a73bf795fe2257dcc6ffb7c62f88686d2385
Instruction Fuzzy Hash: FF218E755093C08FCB02DF24D994715BF71FB46314F28C5EAD8498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UPDATED SSTATEMENT OF ACCOUNT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TgfQNrhQjjseHY.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UPDATED SSTATEMENT OF ACCOUNT.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caww4iwt.cup.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dnlgrcyq.nbj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iyunuva1.4cb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mra1hua4.ssk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3nqfhd4.35i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0tc3v3q.egd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xsh0e31k.x3w.psm1

Windows Analysis Report
UPDATED SSTATEMENT OF ACCOUNT.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre