Edit tour

Windows Analysis Report
sZXuT60Q6P.exe

Overview

General Information

Sample name:	sZXuT60Q6P.exe renamed because original name is a hash value
Original sample name:	94f2ae1b5174532d81d5ea169b7f7726.exe
Analysis ID:	1430171
MD5:	94f2ae1b5174532d81d5ea169b7f7726
SHA1:	a6f144862293920e5376e5b53a1723502c9de2fb
SHA256:	d1b0b9a6b80f54be2a14ff19f3bd682185848d92443fa555a08cb07fa630a230
Tags:	32exeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code references suspicious native API functions

Check if machine is in data center or colocation facility

Contains functionality to capture screen (.Net source)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

sZXuT60Q6P.exe (PID: 6696 cmdline: "C:\Users\user\Desktop\sZXuT60Q6P.exe" MD5: 94F2AE1B5174532D81D5EA169B7F7726)

powershell.exe (PID: 3176 cmdline: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3668 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

svchost.exe (PID: 5908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "gator3220.hostgator.com", "Username": "zt22@qlststv.com", "Password": "28#75@ts76#V1F8h"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4483187709.0000000002884000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: sZXuT60Q6P.exe PID: 6696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: sZXuT60Q6P.exe PID: 6696	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: sZXuT60Q6P.exe PID: 6696	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 3668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3668	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e4d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33ebf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f49:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fdb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34045:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3414d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341dd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.sZXuT60Q6P.exe.3c622a0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.sZXuT60Q6P.exe.3c622a0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.sZXuT60Q6P.exe.3c622a0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3204d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32149:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32245:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3234d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323dd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e4d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f27d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa49d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33ebf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f2ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaa50f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f49:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f379:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaa599:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fdb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f40b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaa62b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34045:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f475:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa695:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f4e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa707:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3414d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f57d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa79d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xfaccd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1360fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x17131d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xfad3f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x13616f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x17138f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xfadc9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1361f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x171419:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xfae5b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x13628b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1714ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xfaec5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1362f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x171515:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xfaf37:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x136367:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x171587:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xfafcd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1363fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x17161d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x14b2fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x18672d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1c194d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14b36f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x18679f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1c19bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x14b3f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x186829:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1c1a49:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x14b48b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1868bb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1c1adb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x14b4f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x186925:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1c1b45:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x14b567:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x186997:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1c1bb7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14b5fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x186a2d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1c1c4d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe', CommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\sZXuT60Q6P.exe", ParentImage: C:\Users\user\Desktop\sZXuT60Q6P.exe, ParentProcessId: 6696, ParentProcessName: sZXuT60Q6P.exe, ProcessCommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe', ProcessId: 3176, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5908, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: 4.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "gator3220.hostgator.com", "Username": "zt22@qlststv.com", "Password": "28#75@ts76#V1F8h"}

Multi AV Scanner detection for submitted file

Source: sZXuT60Q6P.exe	ReversingLabs: Detection: 18%
Source: sZXuT60Q6P.exe	Virustotal: Detection: 35%			Perma Link

Machine Learning detection for sample

Source: sZXuT60Q6P.exe

Joe Sandbox ML: detected

Source: sZXuT60Q6P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: sZXuT60Q6P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: sZXuT60Q6P.exe, 00000000.00000002.2029162979.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034346118.0000000005490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2038802597.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb3 source: powershell.exe, 00000002.00000002.2048506249.0000000007C92000.00000004.00000020.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegAsm.exe, 00000004.00000002.4483187709.00000000028FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: svchost.exe, 00000005.00000002.3637582487.000001876F400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.2040580784.000000000561D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002871000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2040580784.0000000005171000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: RegAsm.exe, 00000004.00000002.4498237173.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000002.00000002.2040580784.0000000005171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBhq
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: RegAsm.exe, 00000004.00000002.4483187709.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipif8
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/T
Source: RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/p
Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.2027291394.000001876F1A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034102813.0000000005430000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/sam210723/goesrecv-monitor/releases/latest
Source: powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034102813.0000000005430000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vksdr.com/goesrecv-monitor

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: sZXuT60Q6P.exe, ScreenCapturePInvoke.cs

.Net Code: CaptureScreen

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, NDL2m67zO.cs

.Net Code: MMM4IwC2IS

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_02933CF4	0_2_02933CF4
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_02932448	0_2_02932448
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_0293246B	0_2_0293246B
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_0293DAFC	0_2_0293DAFC
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04F903F0	0_2_04F903F0
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04F903E0	0_2_04F903E0
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04F9EC78	0_2_04F9EC78
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF54D0	0_2_04FF54D0
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF25C0	0_2_04FF25C0
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FFD380	0_2_04FFD380
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FFAE98	0_2_04FFAE98
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF786A	0_2_04FF786A
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF3818	0_2_04FF3818
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF6960	0_2_04FF6960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F8B77C	4_2_00F8B77C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F84AC0	4_2_00F84AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F83EA8	4_2_00F83EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F8AF30	4_2_00F8AF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F841F0	4_2_00F841F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06603078	4_2_06603078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06603E20	4_2_06603E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_066055C0	4_2_066055C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06600040	4_2_06600040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06604ED8	4_2_06604ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06609EA2	4_2_06609EA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_06609EA8	4_2_06609EA8

Source: sZXuT60Q6P.exe, 00000000.00000002.2027600254.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2029162979.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2029162979.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename1f940a0d-a27b-4ffe-9f6f-6b985da4c6d6.exe4 vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename1f940a0d-a27b-4ffe-9f6f-6b985da4c6d6.exe4 vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000000.2004807672.0000000000703000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameESET.exe, vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2034346118.0000000005490000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe, 00000000.00000002.2034102813.0000000005430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs sZXuT60Q6P.exe
Source: sZXuT60Q6P.exe	Binary or memory string: OriginalFilenameESET.exe, vs sZXuT60Q6P.exe

Source: sZXuT60Q6P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: sZXuT60Q6P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.sZXuT60Q6P.exe.5430000.5.raw.unpack, ConstellationPanel.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, OTWUo99bfyR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, Ui9qhZiA7.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, BqMB7yHhrXg.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.sZXuT60Q6P.exe.5430000.5.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/11@2/3

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sZXuT60Q6P.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1868:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2oeooidd.gzn.ps1

Jump to behavior

Source: sZXuT60Q6P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: sZXuT60Q6P.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002962000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002950000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: sZXuT60Q6P.exe	ReversingLabs: Detection: 18%
Source: sZXuT60Q6P.exe	Virustotal: Detection: 35%

Source: unknown	Process created: C:\Users\user\Desktop\sZXuT60Q6P.exe "C:\Users\user\Desktop\sZXuT60Q6P.exe"
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe'	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: sZXuT60Q6P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: sZXuT60Q6P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: sZXuT60Q6P.exe, 00000000.00000002.2029162979.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034346118.0000000005490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2038802597.0000000003567000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb3 source: powershell.exe, 00000002.00000002.2048506249.0000000007C92000.00000004.00000020.00020000.00000000.sdmp

Source: sZXuT60Q6P.exe

Static PE information: 0x83DBA3F9 [Tue Feb 7 06:40:57 2040 UTC]

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Code function: 0_2_04FF1218 pushad ; ret	0_2_04FF1219
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_037B12F8 push ebx; iretd	2_2_037B131A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07E433B3 push FFFFFF8Bh; retf	2_2_07E433BC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07E40959 push FFFFFF8Bh; iretd	2_2_07E4095B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07E40920 push FFFFFF8Bh; iretd	2_2_07E40922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00F80B4D push edi; ret	4_2_00F80CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0660F372 push es; ret	4_2_0660F380

Source: sZXuT60Q6P.exe

Static PE information: section name: .text entropy: 7.950055534042309

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: sZXuT60Q6P.exe PID: 6696, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002884000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002937000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4920000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594094	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7064	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2498	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7460	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2361	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe TID: 5880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2140	Thread sleep count: 7064 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2140	Thread sleep count: 2498 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6984	Thread sleep count: 7460 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6984	Thread sleep count: 2361 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595463s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5832	Thread sleep time: -594094s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5264	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6396	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594094	Jump to behavior

Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 00000002.00000002.2038802597.0000000003567000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBranchCaMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: RegAsm.exe, 00000004.00000002.4483187709.0000000002937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000005.00000002.3637582487.000001876F41F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3637704790.000001876F45B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3637038791.0000018769C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000004.00000002.4498237173.0000000005C26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2038802597.0000000003567000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FcheSecondaryMSFT_NetEventVmNetworkAdatper.cdxml

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00F87ED0 CheckRemoteDebuggerPresent,

4_2_00F87ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.sZXuT60Q6P.exe.2cec34c.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: MyGetProcAddress(hProcess, Name)
Source: 0.2.sZXuT60Q6P.exe.2cec34c.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: LoadLibraryA(ref name)
Source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, W4ip.cs	Reference to suspicious API methods: ve645LMXEKU.OpenProcess(lUA9OgW.DuplicateHandle, bInheritHandle: true, (uint)aT9Qdac.ProcessID)

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe'			Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\szxut60q6p.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\command-line.exe'
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\szxut60q6p.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\command-line.exe'			Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Users\user\Desktop\sZXuT60Q6P.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sZXuT60Q6P.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\sZXuT60Q6P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sZXuT60Q6P.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3668, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4483187709.0000000002884000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sZXuT60Q6P.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3668, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3c622a0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b9b420.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sZXuT60Q6P.exe.3b4adf0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sZXuT60Q6P.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3668, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	44 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	541 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	271 Virtualization/Sandbox Evasion	SSH	21 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	1 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	271 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sZXuT60Q6P.exe	18%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
sZXuT60Q6P.exe	35%	Virustotal		Browse
sZXuT60Q6P.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://api.ipif8	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://vksdr.com/goesrecv-monitor	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.ipif8	RegAsm.exe, 00000004.00000002.4483187709.00000000028F8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.3637582487.000001876F400000.00000004.00000020.00020000.00000000.sdmp	false		low
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000005.00000003.2027291394.000001876F1A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false		high
https://api.ipify.org/p	RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.	RegAsm.exe, 00000004.00000002.4498237173.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/sam210723/goesrecv-monitor/releases/latest	sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034102813.0000000005430000.00000004.08000000.00040000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000002.00000002.2040580784.000000000561D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.ipify.org	RegAsm.exe, 00000004.00000002.4483187709.00000000028FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.5.dr	false		high
https://api.ipify.org	sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vksdr.com/goesrecv-monitor	sZXuT60Q6P.exe, 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, sZXuT60Q6P.exe, 00000000.00000002.2034102813.0000000005430000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2040580784.00000000052C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2045407904.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBhq	powershell.exe, 00000002.00000002.2040580784.0000000005171000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	RegAsm.exe, 00000004.00000002.4483187709.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002871000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002937000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/T	RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2040580784.0000000005171000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.0000000002821000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.4483187709.00000000028E4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430171
Start date and time:	2024-04-23 08:45:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sZXuT60Q6P.exe renamed because original name is a hash value
Original Sample Name:	94f2ae1b5174532d81d5ea169b7f7726.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/11@2/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 80 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 104.77.8.139
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3176 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:45:55	API Interceptor	20x Sleep call for process: powershell.exe modified
08:45:56	API Interceptor	3x Sleep call for process: svchost.exe modified
08:45:57	API Interceptor	12044296x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	doc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.12.205	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	doc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	DHL_RF_20200712_BN_N0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	gmb.xls	Get hash	malicious	Unknown	Browse	104.26.12.205
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://florideskser.online/login	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	172.67.207.72
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	104.21.45.11
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	Quotation.xls	Get hash	malicious	Remcos	Browse	172.67.206.230
	Invoice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
TUT-ASUS	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	doc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 26519PZ F30 59.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	DHL_RF_20200712_BN_N0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	e-dekont_swift-details.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	shipping document.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8336933431872641
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugJ:gJjJGtpTq2yv1AuNZRY3diu8iBVqF/
MD5:	03A79232D13F7E7AF73DABE38E434788
SHA1:	5AABAF3C4D4FB7E518E609266FD7660F554531C2
SHA-256:	5C8025DEDEA9B5ADF07BEEC82C7AFCB52EA23F6EBE503C531D0D0F093338BB51
SHA-512:	E9C152F66A9FDCCE5BF29A7A44F392CA2B2B882BE1D3C8EC676D37B11F4E4025BD2A27E7418D20EAFFA09139CCC0A56DDA09397253E265B47D1047F736C29B97
Malicious:	false
Reputation:	low
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x43ee7967, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584273642412415
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:5aza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	184588FBF1FE9492EBE68E1D3A007F1F
SHA1:	D3B1E0F9B5CB2F1D7DADD57D5F6E8039CFAE545C
SHA-256:	072A40EC170823AB5B9B08D1C893E5A6A75B1ED264C21C32E3470763E4589CF5
SHA-512:	7D07F47519579AA2A605C26094F2CFDFB77438A4AF98A65F9C3643307F693823CEFB5B8F8435D69F336926159430862A3CD795C24B29BE65BE09CF2AE26AF170
Malicious:	false
Reputation:	low
Preview:	C.yg... ...............X\...;...{......................T.~......1...\|..9-...\|=.h.\|......1...\|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{......................................1...\|...................S:.1...\|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07905187549098011
Encrypted:	false
SSDEEP:	3:vS/lUetYerSUZgjKGKf3OhiO6yBll58Kgvvl/QoeP/ll:eNzrSAmKGKfO6Kz8KgR+t
MD5:	3A7B6AE7DF773C31AB84DDAAB2BB25B2
SHA1:	32E08061766F7FA28C9104594D53C1826BA219F7
SHA-256:	75121D5590FC6521513159C7B132AB357AC66984892BC511F4DFB7DC915E0522
SHA-512:	9DA7E552907A3B1C930AA49FD7E394179F2A4397A2CCBFD8F5977F899A63FD72C13FF6AF90D57F618E86CF88907EC050192FBDB0F7F4BF6FC805C08431280DEC
Malicious:	false
Reputation:	low
Preview:	.c......................................;...{..9-...\|]..1...\|...........1...\|...1...\|......1...\|....................S:.1...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sZXuT60Q6P.exe.log

Download File

Process:	C:\Users\user\Desktop\sZXuT60Q6P.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.337066511654157
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhgLE4qXKIE4oKNzKoZAE4Kze0E4qE4x84j:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze
MD5:	55A2AF8F9FCA3AE99FBA235D3E16A53F
SHA1:	32F34219599006657BFF0B868257916A0C393AAA
SHA-256:	2E0B5859D8501D26669B982BD18005B625352435DB8E1D8B944EED350C1DB0B3
SHA-512:	F6EB6E6AA729963FF23349B6DF3B558896C7B294BF15F6601C4FEF2B1034DEBE207CE04A85F14124CBC41B168157778A23BAA06FCCFE13B0EE262CF2D80FDDA6
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2oeooidd.gzn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj3hruci.d22.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3oo04i5.rk3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rpol341l.nff.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.336421024349973
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	sZXuT60Q6P.exe
File size:	793'600 bytes
MD5:	94f2ae1b5174532d81d5ea169b7f7726
SHA1:	a6f144862293920e5376e5b53a1723502c9de2fb
SHA256:	d1b0b9a6b80f54be2a14ff19f3bd682185848d92443fa555a08cb07fa630a230
SHA512:	297ad4f0d9368a9b64c0b1fa06daa8fbd4e93c9cb917b9c1245b761e1aa059c951883ec343767c2ed5668d262161ec5b37ce9d1fa5733e96cf2bfc9b80c517c8
SSDEEP:	6144:otQiMdN7Lcgh1yba6tPIyJJ8thhzzb84f8r7SzCx16Nm/7UMGLEfSAB2c6H5RNov:X7JYbtPX23fffzjA/oMFiT
TLSH:	28F49DF2D24458D5EC6E13B1D8374C2A2227FDA9B8F5D91E56AE71225BB33D20027D0B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..x..........~.... ........@.. .......................`............@................................

File Icon


Icon Hash:	4c001a0100000001

Static PE Info

General

Entrypoint:	0x45967e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x83DBA3F9 [Tue Feb 7 06:40:57 2040 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x59628	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0x69fea	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x57684	0x57800	a63ac8da0a6fd0d6a519092fb9999901	False	0.9025530133928571	data	7.950055534042309	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5a000	0x69fea	0x6a000	e32048688f8c669a83efe8e994ff2e15	False	0.07613732679834906	data	1.839656211272816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc4000	0xc	0x200	d35ff0300259193a624899830de059ba	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x5a2b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5905 x 5905 px/m	0.2765957446808511
RT_ICON	0x5a718	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 5905 x 5905 px/m	0.21106557377049182
RT_ICON	0x5b0a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5905 x 5905 px/m	0.1824577861163227
RT_ICON	0x5c148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5905 x 5905 px/m	0.14398340248962654
RT_ICON	0x5e6f0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/m	0.11319083608880491
RT_ICON	0x62918	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 5905 x 5905 px/m	0.10646950092421442
RT_ICON	0x67da0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 5905 x 5905 px/m	0.09217994534370401
RT_ICON	0x71248	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5905 x 5905 px/m	0.07982373121968532
RT_ICON	0x81a70	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 5905 x 5905 px/m	0.0636890848300145
RT_GROUP_ICON	0xc3a98	0x84	data	0.7045454545454546
RT_VERSION	0xc3b1c	0x2e4	data	0.4391891891891892
RT_MANIFEST	0xc3e00	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 08:45:57.978689909 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:57.978776932 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:57.978924990 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:57.983285904 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:57.983319998 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.181328058 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.181428909 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.188265085 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.188283920 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.188595057 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.228363991 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.237476110 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.284115076 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.447551966 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.447623014 CEST	443	49707	104.26.12.205	192.168.2.5
Apr 23, 2024 08:45:58.447675943 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.453114986 CEST	49707	443	192.168.2.5	104.26.12.205
Apr 23, 2024 08:45:58.547826052 CEST	49708	80	192.168.2.5	208.95.112.1
Apr 23, 2024 08:45:58.640819073 CEST	80	49708	208.95.112.1	192.168.2.5
Apr 23, 2024 08:45:58.640916109 CEST	49708	80	192.168.2.5	208.95.112.1
Apr 23, 2024 08:45:58.641047001 CEST	49708	80	192.168.2.5	208.95.112.1
Apr 23, 2024 08:45:58.736219883 CEST	80	49708	208.95.112.1	192.168.2.5
Apr 23, 2024 08:45:58.790879965 CEST	49708	80	192.168.2.5	208.95.112.1
Apr 23, 2024 08:46:58.612241983 CEST	80	49708	208.95.112.1	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 08:45:57.880966902 CEST	64637	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:45:57.969527006 CEST	53	64637	1.1.1.1	192.168.2.5
Apr 23, 2024 08:45:58.458319902 CEST	53572	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:45:58.546960115 CEST	53	53572	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 08:45:57.880966902 CEST	192.168.2.5	1.1.1.1	0x2b90	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:45:58.458319902 CEST	192.168.2.5	1.1.1.1	0xa995	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 08:45:57.969527006 CEST	1.1.1.1	192.168.2.5	0x2b90	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:45:57.969527006 CEST	1.1.1.1	192.168.2.5	0x2b90	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:45:57.969527006 CEST	1.1.1.1	192.168.2.5	0x2b90	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:45:58.546960115 CEST	1.1.1.1	192.168.2.5	0xa995	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	208.95.112.1	80	3668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 08:45:58.641047001 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 23, 2024 08:45:58.736219883 CEST	175	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:45:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	104.26.12.205	443	3668	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 06:45:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-23 06:45:58 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 06:45:58 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 878be4cfaf59428e-EWR
2024-04-23 06:45:58 UTC	14	IN	Data Raw: 31 35 34 2e 31 36 2e 31 39 32 2e 31 36 33 Data Ascii: 154.16.192.163

Target ID:	0
Start time:	08:45:54
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\sZXuT60Q6P.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sZXuT60Q6P.exe"
Imagebase:	0x640000
File size:	793'600 bytes
MD5 hash:	94F2AE1B5174532D81D5EA169B7F7726
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2029959997.0000000003AA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:45:55
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\sZXuT60Q6P.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\command-line.exe'
Imagebase:	0x60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:45:55
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:45:56
Start date:	23/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x630000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4475240542.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4483187709.0000000002884000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:45:56
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	0

Executed Functions

Function 02933CF4 Relevance: 2.0, Strings: 1, Instructions: 743
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pphq, xrefs: 02934B00

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: Pphq
API String ID: 0-882776299
Opcode ID: 3bf67e13e0bee732038ec3daed923e391c2615f87787bfb68977e6b83ebe4a1d
Instruction ID: 8e957d8deaa34379ac8738609aa233b5ad102c723a13ce8b2f64f6ce05681dea
Opcode Fuzzy Hash: 3bf67e13e0bee732038ec3daed923e391c2615f87787bfb68977e6b83ebe4a1d
Instruction Fuzzy Hash: 84926078E012298FDB65DF69D984BD9BBB2EB49300F1081E9980DA7364DB359E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0293B2D9 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0293B53E

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1c3ea55a04e2f343409f0b8e7c99f3cd02b21711b7e1766722524118416d0073
Instruction ID: 5ff11ca86cab944d503332ec84b28c736b32a4241566b4f1959a106242e74d00
Opcode Fuzzy Hash: 1c3ea55a04e2f343409f0b8e7c99f3cd02b21711b7e1766722524118416d0073
Instruction Fuzzy Hash: B1814670A00B158FD725DF29D05475ABBF5FF88308F00892ED48ADBA50DB34E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0293D7BC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0293DB96,?,?,?,?,?), ref: 0293DC57

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 59a212fe8a640e8af4449440f5b163c0c87feab09e71724d8b3acf2b4ee219a0
Instruction ID: e07b70165c7097b0a11db8e043371691f751137761d164288a4998f275d330e0
Opcode Fuzzy Hash: 59a212fe8a640e8af4449440f5b163c0c87feab09e71724d8b3acf2b4ee219a0
Instruction Fuzzy Hash: 1E21E3B59002489FDB10CF9AD584AEEBBF9EB48310F14845AE918B3350D378A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0293DBC9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0293DB96,?,?,?,?,?), ref: 0293DC57

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f066dbd5fe1cdca08bff10365398e240435913f5a9058fa635d284b56843d08a
Instruction ID: ff4b67ff5ddc708d2bdfcdc497242aad8ef1557c8b7e2afbe2e325a889cb9483
Opcode Fuzzy Hash: f066dbd5fe1cdca08bff10365398e240435913f5a9058fa635d284b56843d08a
Instruction Fuzzy Hash: 5321E4B59002089FDB10CF9AD584ADEFFF9FB48310F14801AE958A3350D378A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0293A668 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0293B5B9,00000800,00000000,00000000), ref: 0293B7CA

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 023fb15e083529ddc2ee1dc661d198f6971e32344fac65de2f42927dc6e0a8a6
Instruction ID: 7872861ac73e1c58309ec317a825e4a5ce2797065d7db270dfe706ec206b49f7
Opcode Fuzzy Hash: 023fb15e083529ddc2ee1dc661d198f6971e32344fac65de2f42927dc6e0a8a6
Instruction Fuzzy Hash: 991112B69003099FDB10DF9AC484B9EFBF8EB88314F10842AE519A7610C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0293B758 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0293B5B9,00000800,00000000,00000000), ref: 0293B7CA

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6459e96384f4ae29e9d6fb5f5fffce86db422e97428156bd973c91d472de7316
Instruction ID: 0ff733ee12db955f1659a5bd424c0657946f1471133b179fe01f6b6aa1e63bfc
Opcode Fuzzy Hash: 6459e96384f4ae29e9d6fb5f5fffce86db422e97428156bd973c91d472de7316
Instruction Fuzzy Hash: DB11F3B6D002099FDB10CF9AD584ADEFBF8EF88714F10842AD519A7610C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0293B4D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0293B53E

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 81693f5999e2137189b5f0e4fa8c3b6370c21c2678ff4cb84b6457d6e459a350
Instruction ID: d773cb9cd60ad60e1f4cd60c8dd6218765602ce3432fed0bf9158bf64e2e58a4
Opcode Fuzzy Hash: 81693f5999e2137189b5f0e4fa8c3b6370c21c2678ff4cb84b6457d6e459a350
Instruction Fuzzy Hash: 7711F2B6C003498FDB10DF9AD444ADEFBF8EF88314F14846AD519A7210D379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C138 Relevance: 1.4, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 04F9C284

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: efd46f74a2f6ec1c79fb8bc774ce99c389e621e18e9b987d60962ed65bbb403a
Instruction ID: 952f86da5f48f71a25849bb5a4949a5efc9c46c12233ab0f762e9b0be0609eee
Opcode Fuzzy Hash: efd46f74a2f6ec1c79fb8bc774ce99c389e621e18e9b987d60962ed65bbb403a
Instruction Fuzzy Hash: 9D618970A0060A9FCB18CF99D5C08AAF7F6FF88300711CA6AD91997615DB30FC52CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F96CE8 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

4'hq, xrefs: 04F96CFB

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: 4'hq
API String ID: 0-3911794826
Opcode ID: 151a57d3114796f8a61354e6d907018e43061642428bc7c18221cb47b0d4c6f8
Instruction ID: b685fce9a6a62939adcd30086ced3e31228e5e5840c597b00fd246e8d8e8a4f4
Opcode Fuzzy Hash: 151a57d3114796f8a61354e6d907018e43061642428bc7c18221cb47b0d4c6f8
Instruction Fuzzy Hash: A6D0A7611496544FD7192A3475B14E83B62EF812403020486C441069A7CF180D0BC342

Uniqueness

Uniqueness Score: -1.00%

Function 04F9DB48 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5124ddde9e44a2fa2551a5115da8f8faaeb22fb7e91f58a70cadf994d4d0d7
Instruction ID: b0e04f468359711a450bbe2aa8b3059f42eb662dfc5b712d62ceff3d99f8af38
Opcode Fuzzy Hash: af5124ddde9e44a2fa2551a5115da8f8faaeb22fb7e91f58a70cadf994d4d0d7
Instruction Fuzzy Hash: 71B15731B046028FEF25DF39D544AAAB7E6FF84300B24482AE546C7691EB75FD42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04F97E6B Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4e8c2dd1aca013aa83eef27d09d684562d433b277f9df790505e91a0192428
Instruction ID: 6918284af613e2e72f1218c931897d9974f7dc51910d307f4779a5945f554d40
Opcode Fuzzy Hash: cb4e8c2dd1aca013aa83eef27d09d684562d433b277f9df790505e91a0192428
Instruction Fuzzy Hash: EEB1AE306403458FC715DF28E994D5ABBB6FF8931471089A9E04A8B376DB34FD4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F97EB8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9f073ec1222b3aa9aeca2e611b6676590388b707200f2d0170e3c0b8e01a77
Instruction ID: 2ed7ae49305cc78a0e8d8e0c7e79bbc7b63efdb01135e0dc3a4b719f6d6bbf73
Opcode Fuzzy Hash: df9f073ec1222b3aa9aeca2e611b6676590388b707200f2d0170e3c0b8e01a77
Instruction Fuzzy Hash: 27A19D346006059FC715DF28EA84D6DBBB6FF883147108A69E40A9B376DB34FD4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FFEC30 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40222e6e8adeae538e04eff1d6c4d1750b9f60d64100d91db65cbe6b91f749dd
Instruction ID: 9d02242aa807041fba977c19b130ab45f56e2fa7ef47f715a0794ec13687d317
Opcode Fuzzy Hash: 40222e6e8adeae538e04eff1d6c4d1750b9f60d64100d91db65cbe6b91f749dd
Instruction Fuzzy Hash: 5291D475A0060A9FDB15CFA8D984AEEBBF2FF48310F048569E92997360D730E951CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04F9A290 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2738ff845512da709adbc6105ead721c02d39b81c754117107ab7ceda4d85aba
Instruction ID: 7973938132b7583ecc521d23a65652de5e0f6b79c80bd1f3a61cc170c914d619
Opcode Fuzzy Hash: 2738ff845512da709adbc6105ead721c02d39b81c754117107ab7ceda4d85aba
Instruction Fuzzy Hash: 12619D71A0020A9FDB05DF58D980DAEFBBAFF84314B14C929D5199B225DB35FD06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FFEF98 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86df963dbbd8b91dfe9e106fdc5d66be7e2356cd287e94706caa01333a5870b
Instruction ID: c1a13a610981cb0fc3ba2d5018b04d7d3e5c8cb68ac4232a0a4cb74f0a2be250
Opcode Fuzzy Hash: c86df963dbbd8b91dfe9e106fdc5d66be7e2356cd287e94706caa01333a5870b
Instruction Fuzzy Hash: D2715E75A01209AFCB15DF69D884DAEBBB6FF88714B114099FA01AB371D731E882CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CD20 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ddda0abb87a6f3888076d30cb5ad92db26c7b163c5eb69fb4b0b000107fc8c
Instruction ID: 69d51ef01aba542acb44a71b0e456c24e6c504078c1b5bba5fc283e09835deba
Opcode Fuzzy Hash: a3ddda0abb87a6f3888076d30cb5ad92db26c7b163c5eb69fb4b0b000107fc8c
Instruction Fuzzy Hash: B7512432B056904FDB269F28D99085ABBE5EFC572431984BED559CB352CA35FC03C790

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BA6F Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee9342ec27d2d76f553e409601ce4d8f5133e8d9ef9c3b137b9bba3feb87fe
Instruction ID: d6982631d83d6294ca120d1ee65f521765f45b49980e03eb893de00d5969b263
Opcode Fuzzy Hash: 33ee9342ec27d2d76f553e409601ce4d8f5133e8d9ef9c3b137b9bba3feb87fe
Instruction Fuzzy Hash: EC51C3302407049FD315EB34E995A6E7BF6EF89344B04892ED1468B666DF39ED0BCB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9AAB8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520d4e043f16017518525033c9f73917d1bd22678cb075650a9e3a36cd37e150
Instruction ID: 8e5a7ef66000715ccc51166ddb79c79e4ba45a84bc0a0dfa606e67f63b1013b6
Opcode Fuzzy Hash: 520d4e043f16017518525033c9f73917d1bd22678cb075650a9e3a36cd37e150
Instruction Fuzzy Hash: 574180302407015FE319EB24EA41E5ABBA6EF81314F41CA6DD2469B666DF78F90DCB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BAB8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a894ec830a51bda0b9d18c759321381bcdedb6d497a8df04f60fa63558b67ff
Instruction ID: f0125724291a1f74fdc0300ac51f5100db868da1b46d3be6b5c0d2c646fcbc8e
Opcode Fuzzy Hash: 4a894ec830a51bda0b9d18c759321381bcdedb6d497a8df04f60fa63558b67ff
Instruction Fuzzy Hash: 464170302406049FD329EB34EA54E2EB7AAEFC4344B04892DD1468B665DF79FD0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9AAC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e20d1268d7c7eaac6845469b45201f770bcac470e9f16a11d60a5ca83ba2204
Instruction ID: e22c9948549b1fbde55b92ea9c0fce582f83892bba73ff3c9044968c3c077c93
Opcode Fuzzy Hash: 3e20d1268d7c7eaac6845469b45201f770bcac470e9f16a11d60a5ca83ba2204
Instruction Fuzzy Hash: 324190301407015FE319EB24EA40F5A7BA6EF81314F40CA6DD2469B666DF78F909CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B068 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16b0d1a7e710a1ee583350daf855aba92f998b7cd8162b3aa05896c940e5815
Instruction ID: 31297f081046882a06b722339f5aa885532ad6f6544f51d7a40de68374052082
Opcode Fuzzy Hash: c16b0d1a7e710a1ee583350daf855aba92f998b7cd8162b3aa05896c940e5815
Instruction Fuzzy Hash: D6216D313802052BF318AA31AD61B7E3757DFC02A4F08892CE5029F1A8DD79FE4B9390

Uniqueness

Uniqueness Score: -1.00%

Function 04FFF848 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d2bc8bf2dde803674fd7cddf987108f988876300e2009d0d50a55564d47fb1
Instruction ID: 93cac3a4a977c8a94c22ea80e161b8cf58f51a42fe593ae02099d1b2516cfdf2
Opcode Fuzzy Hash: c4d2bc8bf2dde803674fd7cddf987108f988876300e2009d0d50a55564d47fb1
Instruction Fuzzy Hash: DD218C307006018FCB289B38D855A2A73EAEF85718B50847AE606CB3B0DB72EC06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F9E171 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1733ae0d8db732df21db9b13f1870819107dd0608bc47e7544027297bca836a1
Instruction ID: 7d1d3cd3f43475857bf0c4f6717a1a19bf6bb9b0a6803754415bb53f4e25419c
Opcode Fuzzy Hash: 1733ae0d8db732df21db9b13f1870819107dd0608bc47e7544027297bca836a1
Instruction Fuzzy Hash: 271193327452149FEB185F76B458669BBABFFC1626318007EE00AC7281CF29DC83CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0100D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028130800.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5786064e1af2c6a82c4c0e8d491b08a0552bbebcd6f13af2239756ce9cb20fb
Instruction ID: 687392504a8df6364959c844a15efb463b1305f1ad171d1b705db70cf2823275
Opcode Fuzzy Hash: d5786064e1af2c6a82c4c0e8d491b08a0552bbebcd6f13af2239756ce9cb20fb
Instruction Fuzzy Hash: 6A21D371604204DFEB16DFA8D984B16BFA5EB84354F20C5A9E98D4B296C33AD406CB72

Uniqueness

Uniqueness Score: -1.00%

Function 04F9E2D0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0a5ac2f8724da9a7797c4e1904751ee7e85f4e72a714a598871c4efdc19d7b
Instruction ID: dc2084eb33da857e78aee26fad899812d570bcca2d50e2fbe31954d10c152842
Opcode Fuzzy Hash: 8f0a5ac2f8724da9a7797c4e1904751ee7e85f4e72a714a598871c4efdc19d7b
Instruction Fuzzy Hash: FD117F35B047009FE7258F6AE584E16BBE6FF85324B18856AD54E87252C731FC86C750

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B180 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d27c81a10f995f7bee279d227044cc3fc88ae54b15332259a7fc1bf02150279
Instruction ID: 7769db35ce41c35c5bef5f0cad7727d70a95ebae8fac59802c947c85f1134f68
Opcode Fuzzy Hash: 8d27c81a10f995f7bee279d227044cc3fc88ae54b15332259a7fc1bf02150279
Instruction Fuzzy Hash: 6211D071B003068FDB14DFA8E98496ABBE5FFC4264700462DE9168B315EB38ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9E388 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d7ba7d5da98f93c296f5a6adc3915fb91a6eb5ab450d5965ed8670262df8be
Instruction ID: d621e5f5973552a102f7548d8cca2689f2e445763d616293f6e829db7a99ad95
Opcode Fuzzy Hash: c6d7ba7d5da98f93c296f5a6adc3915fb91a6eb5ab450d5965ed8670262df8be
Instruction Fuzzy Hash: BD014031B441115BFF24967E9944B6B7ADEEFC4740F14803AAA0AC73C4DE6AEC439261

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C129 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b1871ae048856cb198a53a1e2c58f3cd9da9c67462e0664d22adc69eecfb7c
Instruction ID: 100e771f5dfeff0eff051793a11d7c6de29b9352d86b7452458d4b6ce9fd6837
Opcode Fuzzy Hash: 79b1871ae048856cb198a53a1e2c58f3cd9da9c67462e0664d22adc69eecfb7c
Instruction Fuzzy Hash: 0E11BB71A002498FCF15CF99D8C08AABBF6FF88310710846AEA19D7251D730BD12CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9A497 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00a664b85ebd123580054c854127b1a8cc6b5a5a3e4c6ecbd1282c74356caa5
Instruction ID: daf80dc6b832540c62807b450bca3f96ff8a5360f52b677227ee06933cd4e540
Opcode Fuzzy Hash: b00a664b85ebd123580054c854127b1a8cc6b5a5a3e4c6ecbd1282c74356caa5
Instruction Fuzzy Hash: 931184706407055FD719EB24E94095ABBAAEF813583148A2DD01A8B666DB75FD0BCB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B190 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59a41d0cfe75efb224b601fa7ff73f6b2a45cb38e3b2a631aa23fb613c9b9a7
Instruction ID: 47baf71d796ef8775373248eacb3410d823b6ae9c6b8d01b13a7690b2a8c5519
Opcode Fuzzy Hash: f59a41d0cfe75efb224b601fa7ff73f6b2a45cb38e3b2a631aa23fb613c9b9a7
Instruction Fuzzy Hash: B7118F71B003168FDB149FA9E98496AB7E5FFC4264710462DE9168B314DB79EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0100D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028130800.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 71ea15a3db48f15bd8586a592fdbed05223a2e802ec7b629684331fa5f31c809
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 8711D075504280CFDB12CF94D5C4B15FFA2FB44314F24C6AAE84D4B696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 04F9A4A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c188bd0a379b8eadce291efe7e1f58ce97bec6b4f1d41012f75ee69824fcc310
Instruction ID: dd2dead81e57635877b1fa10a3ceeb22a2bd247cc2e2adb7935ea776b3644fdf
Opcode Fuzzy Hash: c188bd0a379b8eadce291efe7e1f58ce97bec6b4f1d41012f75ee69824fcc310
Instruction Fuzzy Hash: A01151302007055FC729DB28E950C5EBBAAEFC03583148A2DD05A8B665DF76FD0BCB80

Uniqueness

Uniqueness Score: -1.00%

Function 04F9D240 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed590bbac31f5676c993b5cdb787b1e9e174f7ceacab1ddaf45068c6dcedf1ab
Instruction ID: 25a77d9d92dbb3a692bcb3b998134f36aecda40c24edf79fad910a96e7a0965f
Opcode Fuzzy Hash: ed590bbac31f5676c993b5cdb787b1e9e174f7ceacab1ddaf45068c6dcedf1ab
Instruction Fuzzy Hash: 1301A7717402046FE318967D9A14B2BBADAEFCD254B10803EE60AD7385DE35EC02C760

Uniqueness

Uniqueness Score: -1.00%

Function 04F9D23C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5392ae04f89457ccc5d1dccb780da11275ef606a6b986698bf337d122184a8
Instruction ID: 86b4bf4229c121143d8d4fc27de094a65bc18bb9223ad5826e85e4239d477cd0
Opcode Fuzzy Hash: 2a5392ae04f89457ccc5d1dccb780da11275ef606a6b986698bf337d122184a8
Instruction Fuzzy Hash: 9901A7717402446FE318967DAA24B2ABADAEFCD254B10803EE60AD7385DE35EC02C750

Uniqueness

Uniqueness Score: -1.00%

Function 04F96B43 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b0aa2f16422660b9be25cfd4714b477f78e26def1351b360a47dcefb20abeb
Instruction ID: 9670d3c1d52b5fcdc7e24d18250fb0f3a6ba5ee09e8fd4bc9f33ab30c0a69af2
Opcode Fuzzy Hash: d9b0aa2f16422660b9be25cfd4714b477f78e26def1351b360a47dcefb20abeb
Instruction Fuzzy Hash: AE014C721483854FD712CF2CE4514CA3FB5EF92300705449AE4818F253EA24FD0AC3E2

Uniqueness

Uniqueness Score: -1.00%

Function 04F9D3F8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4768bb88d6c52a6cbd5abfda73ec4da0bb730c4f298d0c8284a3782440073c7
Instruction ID: 68fae3e0229124a20c49085f80f244eb06ff57253c8a46bd9e2706c2df66d37d
Opcode Fuzzy Hash: e4768bb88d6c52a6cbd5abfda73ec4da0bb730c4f298d0c8284a3782440073c7
Instruction Fuzzy Hash: E1F0A43220420AAFD714DAA9EC40C9FB7ADFF84364700853AE118C7150EA32E801C790

Uniqueness

Uniqueness Score: -1.00%

Function 04FFF439 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7026bbbe377b17af34f718471432fd2fc70cec109a4d87d358f0e70458b9229d
Instruction ID: c2cf8581be9c9ffdf401885bed900658a6a76ce1e8cf3ecc63aa30f1afa1bf05
Opcode Fuzzy Hash: 7026bbbe377b17af34f718471432fd2fc70cec109a4d87d358f0e70458b9229d
Instruction Fuzzy Hash: 6DF01D353005108FD744D76EC899A6937DADFC9615B1480A6E609CB374DE61EC028B60

Uniqueness

Uniqueness Score: -1.00%

Function 04F98248 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6ef53cd5975a937852ea2445b344d73c79808cbc882eefb5748cdd3bed6ae4
Instruction ID: 8a23fee4f80b5bdfc13ab838d47a9eac9b84261873d108d946f3dd2a00d57c88
Opcode Fuzzy Hash: cd6ef53cd5975a937852ea2445b344d73c79808cbc882eefb5748cdd3bed6ae4
Instruction Fuzzy Hash: D0012832715D019FEB07AF18E9C42193BB2FBC1384B1AC051D5018B296DB31FC438B55

Uniqueness

Uniqueness Score: -1.00%

Function 04F96B60 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc0551d82f29b7167c1c0bdd5ae96064a715e6dbf03e65781360e9d1a24cab5
Instruction ID: 318eac51586aa7ff07238dd1ea6e659a0b9d6272fdaf3aa088a3c0ab104ac393
Opcode Fuzzy Hash: 0dc0551d82f29b7167c1c0bdd5ae96064a715e6dbf03e65781360e9d1a24cab5
Instruction Fuzzy Hash: F3F0C2322406194BDB21DE6CE54099E7BEAEFC0310B048929F8428B355EF74FD0A83A1

Uniqueness

Uniqueness Score: -1.00%

Function 04FFF448 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d222e4e4301d78c56fa11206865f1b1e78b31803c7ac10e25cdc1583272e0a1
Instruction ID: bc3cd67ec6dfc3bfc59224552542cc7803c1bf788eff09d616f6706eaaed6def
Opcode Fuzzy Hash: 6d222e4e4301d78c56fa11206865f1b1e78b31803c7ac10e25cdc1583272e0a1
Instruction Fuzzy Hash: CBF01D353101108FC744DB6ED89896A77EAEFCD611B1440ABE60ACB375DE70EC028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9D3F6 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c6cf1871d7c8fc3518467b5827d8c39503e21d90c95cbdd8f7a26cc03c2864
Instruction ID: 1af89f288e05bb36bb7c91c9193d11958fe64125ce222e4396be336f6301c771
Opcode Fuzzy Hash: 64c6cf1871d7c8fc3518467b5827d8c39503e21d90c95cbdd8f7a26cc03c2864
Instruction Fuzzy Hash: 5FF0963220020AAFCB14DFA4ED40C9FB7A9FF84354700853AE519C7224EB71ED02C790

Uniqueness

Uniqueness Score: -1.00%

Function 04F9E2C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a681d93c09c4c587f2181bf8373220f4866611389e4b4b00d2868a408bdc41e9
Instruction ID: f72bf86d6fa51908f8a681d9fd4c5657cff9bf84b48fc4c767af99cf6778450f
Opcode Fuzzy Hash: a681d93c09c4c587f2181bf8373220f4866611389e4b4b00d2868a408bdc41e9
Instruction Fuzzy Hash: ABF089352093805FE322CF76EA44852BFE6EFC625431585AED549C7662D721EC47C721

Uniqueness

Uniqueness Score: -1.00%

Function 04F966E9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024645411dfa334aa240dc6f3548d5239eba9ebc577bfe3255c7246ab5fdfa28
Instruction ID: dd829c5c0f22bc3eee4a7d63494f6bdc4183597d49d5fb525508cf21088d015b
Opcode Fuzzy Hash: 024645411dfa334aa240dc6f3548d5239eba9ebc577bfe3255c7246ab5fdfa28
Instruction Fuzzy Hash: 31F027736042297FE7000E55AC20ABF7FA9EB802B1F04406BFE4483240D9368E14A360

Uniqueness

Uniqueness Score: -1.00%

Function 04F966F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca76030e51d738eb073623f62cdaaed321a193aa3260b657fc45e98953f3974d
Instruction ID: 927e0ac1c0b86f41bc29172b665d766dfc96a469a7d08abaec2580c302f24677
Opcode Fuzzy Hash: ca76030e51d738eb073623f62cdaaed321a193aa3260b657fc45e98953f3974d
Instruction Fuzzy Hash: B0E092376002297FE704198AAC10ABF7B9EFB842B1F04402AFA44C2240CA369E54A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B268 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8b32c02890a17f8d1860a7bba27bcba7ebaa93c8038ab360b50c4350da727a
Instruction ID: 4abe12ecc8dd7c611c3b4fda7464ce60522b261c42dcd62035e05d8e53189015
Opcode Fuzzy Hash: ae8b32c02890a17f8d1860a7bba27bcba7ebaa93c8038ab360b50c4350da727a
Instruction Fuzzy Hash: 70F015B1D09208AFCB45DBA8E89608CBFB0EB46300B0080EAD40897265EA341A0BCB81

Uniqueness

Uniqueness Score: -1.00%

Function 04F9E4F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8468060dd7f187561c12df818a31b398f0404b5fd4ead2faf5aa0827e630ee7
Instruction ID: fa6caf3e0a0893b7149f99bba58272211543c45cd5c736cbd365929d5055d812
Opcode Fuzzy Hash: f8468060dd7f187561c12df818a31b398f0404b5fd4ead2faf5aa0827e630ee7
Instruction Fuzzy Hash: C7E04F763001145B87209A5EE404D9ABBADEBD87717148037F608C7360CA72DC5287A4

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B278 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4eaad0560f25e5142d863af6224fb333060555aafd2b7f76acaba8bd5d2047
Instruction ID: b86193f487a59a68671131973285aa99bb56be06405953a1aa291ccf1c443740
Opcode Fuzzy Hash: 4a4eaad0560f25e5142d863af6224fb333060555aafd2b7f76acaba8bd5d2047
Instruction Fuzzy Hash: 7CE09270E0430CAFCB44EFA9E54559DBBF9EB48300F0085A99809A7354EA345A498F81

Uniqueness

Uniqueness Score: -1.00%

Function 04F9B240 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41ba2b4de74e1ee1edf2e3c37a2928491d8fe3ff5fc0def53bd43241124d9a0
Instruction ID: 12d9d56d6730c33f1309d24f3840de69fe11d0ce30ee69dc70fd15d837388e2b
Opcode Fuzzy Hash: c41ba2b4de74e1ee1edf2e3c37a2928491d8fe3ff5fc0def53bd43241124d9a0
Instruction Fuzzy Hash: 9DD0C9A6D0B3485FD7168BA4B8970C97F64EA2760470101D6D5488B623E5255A139392

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C941 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e94789ac2ae3c132103517ba6b2ece256be4fff98c2232d1aa17b4776d2214
Instruction ID: 2f1fec1ee7639a68c41b6973288c971329dc9c4ffce2d50b08ebfab21ce4c296
Opcode Fuzzy Hash: 13e94789ac2ae3c132103517ba6b2ece256be4fff98c2232d1aa17b4776d2214
Instruction Fuzzy Hash: 9CD0C992C0D7C14FEF2353B454AA0D83FA0DD2320470E55D6C4C4AB063D614944FD752

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BD20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65d45b3751d115a5e4478e3dbb168e62a476bf8b61faf8533d39c2d018936e9
Instruction ID: 7356acd268aa8a38af0702a52aa62107cb96754c304abb1efa3cc45976f81899
Opcode Fuzzy Hash: c65d45b3751d115a5e4478e3dbb168e62a476bf8b61faf8533d39c2d018936e9
Instruction Fuzzy Hash: 0DD0C9E2C0A7818FEB12563451A60C83FB1E96221530A55C6D4918B123E11C590B9726

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C969 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a516b3b0c5bc26c7a99eaf6d5f5674b0e3ae169744cda6de1ee4c2bac9c667
Instruction ID: a51654f4495bda65d6a20165bb94188df2eadbc7b675a4992fca92bbe223cbaf
Opcode Fuzzy Hash: b6a516b3b0c5bc26c7a99eaf6d5f5674b0e3ae169744cda6de1ee4c2bac9c667
Instruction Fuzzy Hash: 20D012728596890FD70227B0F54B2D43F24DE4650470641A1D48C6A017E6580A4F8B91

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BD47 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355dda75fdf52dbabe146b86831035b8cf20855d56a65f604051dcaeee500437
Instruction ID: b7507d44733eb4e000801af40ff0cb63f992a7fdf7a2631511615c5416402bb1
Opcode Fuzzy Hash: 355dda75fdf52dbabe146b86831035b8cf20855d56a65f604051dcaeee500437
Instruction Fuzzy Hash: 0EC080B3C156468FC7022F10B9DE5C43F74FD116153440151DC4B4A517791C190797A1

Uniqueness

Uniqueness Score: -1.00%

Function 04F9CE90 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1813bc13fdec6fa8a58493c961585260e3c65b016a91c062a9a28fc84240eb
Instruction ID: 775c46bc870709ea26050c8f4a69926f1b0c045b5d113e384eaeb606b31c6ab2
Opcode Fuzzy Hash: 1e1813bc13fdec6fa8a58493c961585260e3c65b016a91c062a9a28fc84240eb
Instruction Fuzzy Hash: 4CD097B45442810FD3048B348EC04067FA3EF80300F80C07DD2008F0A5C87D9C07CB12

Uniqueness

Uniqueness Score: -1.00%

Function 04F9BD58 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7189ab52b7747392bc4aebe37541954de1c4bfa92e3f4fcdfb1e91432913c348
Instruction ID: 682d089d6d1cb00f264aa6fa34ca7a22174b6d4fd912b836c452a9afa9a69441
Opcode Fuzzy Hash: 7189ab52b7747392bc4aebe37541954de1c4bfa92e3f4fcdfb1e91432913c348
Instruction Fuzzy Hash: 20B0123145060F8FC5007B54FA09D043B6DF9407157C01220E00E0B0195B6D6D0586E9

Uniqueness

Uniqueness Score: -1.00%

Function 04F9C978 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2706641f755d31247a8e4b1bc63c1c447392212f34ce039ef3451a604b1dd32f
Instruction ID: b5b1bc48b1b6a2b8d0bc6f9bd87090f36ffea2d7894704835d2e66b9b31183b0
Opcode Fuzzy Hash: 2706641f755d31247a8e4b1bc63c1c447392212f34ce039ef3451a604b1dd32f
Instruction Fuzzy Hash: C1B0123105060F4FC5017BE4F605A25371DEDC0605B400120E10D06419AF6D7D05C6D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04FFD380 Relevance: 7.1, Strings: 5, Instructions: 830COMMON

Download Yara Rule

Strings

Hlq, xrefs: 04FFDDA8
(ohq, xrefs: 04FFDD31
(ohq, xrefs: 04FFDD3B
,lq, xrefs: 04FFDACF
,lq, xrefs: 04FFDABF

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: (ohq$(ohq$,lq$,lq$Hlq
API String ID: 0-2131233575
Opcode ID: 6239d0d0fbedfaaa115310318e1c29f6941ce1e0167dff81ce9b7d7ce85a76b5
Instruction ID: 23c57e19996ad77c58ac5caee3d293b9f0c523bbe64ffddd81cabd2825049d2b
Opcode Fuzzy Hash: 6239d0d0fbedfaaa115310318e1c29f6941ce1e0167dff81ce9b7d7ce85a76b5
Instruction Fuzzy Hash: 69626035B00115DFCB18DF69D888A6EBBB2BF85310B158169E916DB3B1DB35EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FF6960 Relevance: 1.8, Strings: 1, Instructions: 591COMMON

Download Yara Rule

Strings

Hbiq, xrefs: 04FF69B3

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: Hbiq
API String ID: 0-2810847684
Opcode ID: 2e9e05d7cccfe27f34f7e5407167b0a3f9ffa2144d21c35b789df74d7ac70d3c
Instruction ID: 1993c8a6af832d782fae2538501b94ce8c59a198d6efae075851b319e611b829
Opcode Fuzzy Hash: 2e9e05d7cccfe27f34f7e5407167b0a3f9ffa2144d21c35b789df74d7ac70d3c
Instruction Fuzzy Hash: 35424A35A006099FDB14DF68C984AAEBBF2FF48310F158599E945AB361DB30FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04F9EC78 Relevance: 1.3, Instructions: 1271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a4a0ad38b9170312348001c0a0040bbe89be75b72aa8c81920500e62b8889b
Instruction ID: 3f7c894f967fc1cfde8dbb999544be8a8b09a4e11531756999adc1e71ec4e542
Opcode Fuzzy Hash: b8a4a0ad38b9170312348001c0a0040bbe89be75b72aa8c81920500e62b8889b
Instruction Fuzzy Hash: 4EC21834A00219CFEB25DF64D954AADBBB2FF89305F1085A9D80AE7254DB35ED82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04FFAE98 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0852435c1cd2044bc9c7adce868ff582945d8559c86766e88608417a1de73531
Instruction ID: c469e7512e1c6b276f8e9fd8ee6fae57edb5f06932cb004802a801bbd02478fc
Opcode Fuzzy Hash: 0852435c1cd2044bc9c7adce868ff582945d8559c86766e88608417a1de73531
Instruction Fuzzy Hash: 55625C75E002599FDB11CF58C984AAEBBB2FF88310F198495E915AB366D734FC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FF25C0 Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13764aa49540ccb674dd84ab0235ae765821d45f3912ddb252de41bd9eb8d6bf
Instruction ID: 9cc8e4d943bec1dd14257372e246189e75fcba82d358d11750e7c793883b0a78
Opcode Fuzzy Hash: 13764aa49540ccb674dd84ab0235ae765821d45f3912ddb252de41bd9eb8d6bf
Instruction Fuzzy Hash: 59326F35B002099FDB14DFA4D944AAEBBF6FF88310F158069EA059B365DB35ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FF54D0 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f44d129f6efc765d5462e9192e0778fc43b4b6b0acab0a86f39657d9fdeae83
Instruction ID: 3cc849d7bfc5438bc3ec03f051559ab4eb8521c8b8cac05244802afbd6d6232d
Opcode Fuzzy Hash: 9f44d129f6efc765d5462e9192e0778fc43b4b6b0acab0a86f39657d9fdeae83
Instruction Fuzzy Hash: CA126C75A002059FDB05DF68CA84A6ABBF2FF88300B15C499E509DB366D734FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FF3818 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca18b44ed9cead9d2985881b6def416a3de4baca04b8a5370fd09007c9531ccf
Instruction ID: f0473b6a9d09c81e9c10d87b4da36deb0f7917836ec482c8dc47909e4faea651
Opcode Fuzzy Hash: ca18b44ed9cead9d2985881b6def416a3de4baca04b8a5370fd09007c9531ccf
Instruction Fuzzy Hash: 0CF15975A00605CFDB25CF69C984A6ABBF2FF48300F148569E9569B7A2DB34F842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04F903F0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3739163624e38c8e895efff764acda50886106a7669591756a6881581d173ccb
Instruction ID: bded91ad237d93179426de31ea808f8d30e99c1068ca0e91e18529b99ba7fab7
Opcode Fuzzy Hash: 3739163624e38c8e895efff764acda50886106a7669591756a6881581d173ccb
Instruction Fuzzy Hash: 591296B0401746EAD310CFA7E95C18A3BB1FB8531EF504649E2612F2E9DBBC595ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 04FF786A Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585dc32d20313f4dfa14383e9302228f60bf63c13827311fd94fd82c6f2bda3a
Instruction ID: 9cde36c7b5a58f006fde1bf34e0dc46b07f2c7bca76cfbbdc8f75c54deca5a52
Opcode Fuzzy Hash: 585dc32d20313f4dfa14383e9302228f60bf63c13827311fd94fd82c6f2bda3a
Instruction Fuzzy Hash: E3C1E975B006058FDB04DF69C994AAABBF2FF49310B1584A9EA059B376DB34EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0293DAFC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de658d21362dcfd720e0ab25757691292fd401f8fb8a20f2f80fc32bb6a2bc3c
Instruction ID: 6ab2c6615937ef8455a435f841c85921657012cbc241a937f9b76e18fd20e0ed
Opcode Fuzzy Hash: de658d21362dcfd720e0ab25757691292fd401f8fb8a20f2f80fc32bb6a2bc3c
Instruction Fuzzy Hash: 9BA15C32E002198FCF0ADFB5C9449DEB7B6FF85304B15856AE806AB225DB35E916CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04F903E0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2031546316.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f90000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782b6b5e2ba7b36d2f1328491175171d6a50cac9217580d9e0bf2c52183c7e7
Instruction ID: d91099265daac38e680c515f80912ab0871ce0275fafc66aa39dd3edad093c7d
Opcode Fuzzy Hash: 9782b6b5e2ba7b36d2f1328491175171d6a50cac9217580d9e0bf2c52183c7e7
Instruction Fuzzy Hash: ACC119B0801746EAD710CFA7E95818A3BB1FB8531EF514209E2612F2E9DBBC594ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 02932448 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc7ac7b2e8642c056413935a27f5a8eab9cff0e320fb488b4ab0f626ad2f693
Instruction ID: 97597ceccd90f2f697220d323ca73c453766669dbc969b6a61724854ab5fa351
Opcode Fuzzy Hash: 5fc7ac7b2e8642c056413935a27f5a8eab9cff0e320fb488b4ab0f626ad2f693
Instruction Fuzzy Hash: 5041D643C65A2C8FD72347BE68F62C15744DBAF17CB54A261C86C996E6F5480E8BC3C2

Uniqueness

Uniqueness Score: -1.00%

Function 0293246B Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028808729.0000000002930000.00000040.00000800.00020000.00000000.sdmp, Offset: 02930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2930000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876bdb122bc6dc58e0600a26ed5d7895597f07b3037e4b31a292e77406b5d2d0
Instruction ID: 22ab12644d58b4c863404a1503608068a385101ebc0e1f96bc9583efe862e4e2
Opcode Fuzzy Hash: 876bdb122bc6dc58e0600a26ed5d7895597f07b3037e4b31a292e77406b5d2d0
Instruction Fuzzy Hash: 23219503D54A288BDB27477E48BA3C1178597EF17CB54A211C96C547FAF6884D4BC382

Uniqueness

Uniqueness Score: -1.00%

Function 04FFCD30 Relevance: 7.8, Strings: 6, Instructions: 327COMMON

Download Yara Rule

Strings

d8mq, xrefs: 04FFD1E0
Hlq, xrefs: 04FFD0F1
,lq, xrefs: 04FFCE48
(ohq, xrefs: 04FFCE82
,lq, xrefs: 04FFCE54
(ohq, xrefs: 04FFCE76

Memory Dump Source

Source File: 00000000.00000002.2031889371.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_sZXuT60Q6P.jbxd

Similarity

API ID:
String ID: (ohq$(ohq$,lq$,lq$Hlq$d8mq
API String ID: 0-2572861041
Opcode ID: 4be95fe23fef38831617f732de41893a8a6a6e4c0ffb4c8315358ff789f8ddae
Instruction ID: cae5b6ac0f572cebece9359d1fce7944f56df0dd1f987290e5047e06a4800619
Opcode Fuzzy Hash: 4be95fe23fef38831617f732de41893a8a6a6e4c0ffb4c8315358ff789f8ddae
Instruction Fuzzy Hash: 31C14D30B102189FCB149F69D958AAE7BB6BF88740F148069E906D73A5DF34EC42DB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3176, Parent PID: 6696COMMON

Executed Functions

Function 07E41C10 Relevance: 5.6, Strings: 4, Instructions: 601COMMON

Download Yara Rule

Strings

4'hq, xrefs: 07E420B0
4'hq, xrefs: 07E420BA
4'hq, xrefs: 07E41F4E
4'hq, xrefs: 07E41F58

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: 4'hq$4'hq$4'hq$4'hq
API String ID: 0-1943722090
Opcode ID: 58bc853d276d979033895ad2be039223c0305de37fac563a3a07d65ef563f7ae
Instruction ID: 9de9700c7c381a29a73f58fbc847f85816bda789aa6b654962a4bd377d8ffc1d
Opcode Fuzzy Hash: 58bc853d276d979033895ad2be039223c0305de37fac563a3a07d65ef563f7ae
Instruction Fuzzy Hash: DA127BB1B053198FCB158B69A8117BABBA6AFC2315F14C0BBD905CF651DB31C8C1C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 037B4C20 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

/o^, xrefs: 037B4CDA

Memory Dump Source

Source File: 00000002.00000002.2039793578.00000000037B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 037B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37b0000_powershell.jbxd

Similarity

API ID:
String ID: /o^
API String ID: 0-2733036372
Opcode ID: ec63a83ab79227435d39b9398b154c923958cff2ed8496669caee181012435c5
Instruction ID: a29424dbcdc19b5299d579996c81334f7eb97478a9847d09350fcf11e9b3be38
Opcode Fuzzy Hash: ec63a83ab79227435d39b9398b154c923958cff2ed8496669caee181012435c5
Instruction Fuzzy Hash: 3841727490A3D55FC703DB7CD8A09DABFF4AF46210B0540D7D484DB263D628D849CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 037B29F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2039793578.00000000037B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 037B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ccbb08e146a6f493f181ec55df3aaad44b2c066ecb4117c0709855261732f9
Instruction ID: f6fe119411ecbf33fa437a850258ef3414b0a12039f1301459aa494be0d54cef
Opcode Fuzzy Hash: 39ccbb08e146a6f493f181ec55df3aaad44b2c066ecb4117c0709855261732f9
Instruction Fuzzy Hash: 97915A70A01605CFCB15CF58C594ABEFBB5FF49310B288599D815AB3A6C735EC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07E41BF0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9a849e3f832e63f44300227c0d2a0764b309775e332000cc34bcd657720f93
Instruction ID: e095920c068189256cffde5fe58596b36d9c587aa31e1ad858be027566105e04
Opcode Fuzzy Hash: 4b9a849e3f832e63f44300227c0d2a0764b309775e332000cc34bcd657720f93
Instruction Fuzzy Hash: F74149F1B4630A8FCF25CF25A941AB977B2AF82349F0590A6C804DF655DB31C8C4C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 037B2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2039793578.00000000037B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 037B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccdac762157dffe3c04af838ba3f395f342d1bd8dca062af32328347b397dc3
Instruction ID: eca5f3beba9f5f8dcc3c19a74fabf76148db6ec4190e48eae98c2ff9e76504ce
Opcode Fuzzy Hash: fccdac762157dffe3c04af838ba3f395f342d1bd8dca062af32328347b397dc3
Instruction Fuzzy Hash: 4F412674A015099FCB05CF58C598AFAFBB1FF48310B1585A9D815AB366C732EC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 037B4C10 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2039793578.00000000037B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 037B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_37b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc0968cf18ae15f71b47d99324f3d17abde8da611a631960b0f3d9e4213b19b
Instruction ID: a55fd8600665c5e6cbacf864184e8d3f7531922d6e768b4486fe0f68fd2efd1a
Opcode Fuzzy Hash: 7cc0968cf18ae15f71b47d99324f3d17abde8da611a631960b0f3d9e4213b19b
Instruction Fuzzy Hash: 5C211A74A042498FCB00CF99D9809AEFBB5FF89310B158199D815AB362C331ED45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0369D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2039389938.000000000369D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0369D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_369d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe77faff44345ac7bc7b75ffd78859b9a857da86fbea1067758a60d53ad93b2b
Instruction ID: cf96f02ba51f6e550cf6868c9bb2c8da2855bb5a33dd8b16529d30b59b22b8ed
Opcode Fuzzy Hash: fe77faff44345ac7bc7b75ffd78859b9a857da86fbea1067758a60d53ad93b2b
Instruction Fuzzy Hash: F7014C714093809FEB128F258D84752BFA8EF53224F19849BE9888F2A7C2795845CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0369D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2039389938.000000000369D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0369D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_369d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f9e0ed6b3fd31ed49aaac21d8d5bea4ff5cdececbd5da749e58dbee1c02f12
Instruction ID: 622b4eecb13db656cbccbd80cc4ad247f8d1c0f9383d73b36383417fc3d948be
Opcode Fuzzy Hash: 56f9e0ed6b3fd31ed49aaac21d8d5bea4ff5cdececbd5da749e58dbee1c02f12
Instruction Fuzzy Hash: 670184714053449AEB20CE15CD84B66FF9CEF46324F1DC57AED480B246C2799842C6B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07E40D30 Relevance: 12.9, Strings: 10, Instructions: 428COMMON

Download Yara Rule

Strings

tPhq, xrefs: 07E40DBB
$hq, xrefs: 07E40FF4
$hq, xrefs: 07E41172
$hq, xrefs: 07E4117E
$hq, xrefs: 07E41147
4'hq, xrefs: 07E40F12
tPhq, xrefs: 07E41084
tPhq, xrefs: 07E41090
tPhq, xrefs: 07E40DC7
4'hq, xrefs: 07E40F1E

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: 4'hq$4'hq$tPhq$tPhq$tPhq$tPhq$$hq$$hq$$hq$$hq
API String ID: 0-1426614148
Opcode ID: 77d319cb929d9014a21d2aa391e7822907b53ac1c27a044d5b229e551a39d411
Instruction ID: 4f20de2fb33c18a341642cbc3bd56794c6d70ae6bd8011644e757318a60aad66
Opcode Fuzzy Hash: 77d319cb929d9014a21d2aa391e7822907b53ac1c27a044d5b229e551a39d411
Instruction Fuzzy Hash: 16D15C717063499FCB258B6DA8157A7BBB6AF82314F14C0BBD505CB291DA35C8C4C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07E41270 Relevance: 9.1, Strings: 7, Instructions: 382COMMON

Download Yara Rule

Strings

tPhq, xrefs: 07E412ED
4'hq, xrefs: 07E414E1
$hq, xrefs: 07E412A8
$hq, xrefs: 07E412B4
$hq, xrefs: 07E41282
tPhq, xrefs: 07E412F9
4'hq, xrefs: 07E414D7

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: 4'hq$4'hq$tPhq$tPhq$$hq$$hq$$hq
API String ID: 0-1980957156
Opcode ID: 8fe14a6644c2f0dc20462e786defe1c38f8ffff1d94033bfe98eb8b84e93e31b
Instruction ID: bce1dfe197cad6b16ec2279bf857078514d58d8fcb79660e76dd0483de182cd9
Opcode Fuzzy Hash: 8fe14a6644c2f0dc20462e786defe1c38f8ffff1d94033bfe98eb8b84e93e31b
Instruction Fuzzy Hash: AEC148B27053198FCF209B6DA4112AABBE6EFC2214F1980BAD805CB751DA35DCC5C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07E404E0 Relevance: 9.1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

Strings

$hq, xrefs: 07E406F4
4'hq, xrefs: 07E405EF
$hq, xrefs: 07E406E8
tPhq, xrefs: 07E4072D
tPhq, xrefs: 07E40739
4'hq, xrefs: 07E405E3
$hq, xrefs: 07E406C2

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: 4'hq$4'hq$tPhq$tPhq$$hq$$hq$$hq
API String ID: 0-1980957156
Opcode ID: 1e7670c990f6bb21411c25780136e7a5ef48e10effc8cccf5ac114d997397e4c
Instruction ID: 5df07a60d7d00776d67bd7e08491bfc4ff42671f0293423466bdfa6370965971
Opcode Fuzzy Hash: 1e7670c990f6bb21411c25780136e7a5ef48e10effc8cccf5ac114d997397e4c
Instruction Fuzzy Hash: C2A16DB27053158FC7219B79A8106BBBBA6EFC5214F1884FBD605CB692DB35CC81C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07E43228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$hq, xrefs: 07E4323A
$hq, xrefs: 07E43290
$hq, xrefs: 07E43256
$hq, xrefs: 07E43284

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: $hq$$hq$$hq$$hq
API String ID: 0-3863560591
Opcode ID: e92f64b9278092ece9143fbf2ba3f78f6b5f39a03beaa4eaca6b2cc79ca925b0
Instruction ID: 67e9c4ef03e47d1055d00be7601a47acc5763d834f45e78aa9e722844a78e652
Opcode Fuzzy Hash: e92f64b9278092ece9143fbf2ba3f78f6b5f39a03beaa4eaca6b2cc79ca925b0
Instruction Fuzzy Hash: D42188B13153165BD724592FA801767BB9BAFC1724F24942AE804DB785DD36C880C378

Uniqueness

Uniqueness Score: -1.00%

Function 07E40308 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

$hq, xrefs: 07E40352
4'hq, xrefs: 07E40373
$hq, xrefs: 07E4035E
4'hq, xrefs: 07E4037F

Memory Dump Source

Source File: 00000002.00000002.2048817125.0000000007E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7e40000_powershell.jbxd

Similarity

API ID:
String ID: 4'hq$4'hq$$hq$$hq
API String ID: 0-646479249
Opcode ID: 060baacb594875a48a6528b8a50754157510bdf1a97687b050576d62619f4b12
Instruction ID: 2a8c5477ca7e128146be5851c35917f935aaa829e81e25618b6b8800c02ac68a
Opcode Fuzzy Hash: 060baacb594875a48a6528b8a50754157510bdf1a97687b050576d62619f4b12
Instruction Fuzzy Hash: D101266130A3854FC72B566968302B63FB6AFC2510B1A41FBD181CB792CD1A4C45C7BB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 3668, Parent PID: 6696COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.2%
Total number of Nodes:	258
Total number of Limit Nodes:	31

Executed Functions

Function 00F87ED0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00F87F47

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 202eb557a4098277979cade251672c94be68c163863fcf4f60a5bfd471f04c42
Instruction ID: 68064eeb35a20dcfb229be535633691867d14b9e41482d09ea2291ea65a86745
Opcode Fuzzy Hash: 202eb557a4098277979cade251672c94be68c163863fcf4f60a5bfd471f04c42
Instruction Fuzzy Hash: E92137B19012598FCB10DF9AD884BEEFBF4EF49320F14845AE559B3250D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0660A892 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0660A9AA

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5a1af7538e275933870df6d5c3e821df2bb65d18b00e4bd8acf360ccbe9aabe2
Instruction ID: 956cdfd70210cf94595beb00987ba07a626fd6f728de35f25dc214e8ab2640ce
Opcode Fuzzy Hash: 5a1af7538e275933870df6d5c3e821df2bb65d18b00e4bd8acf360ccbe9aabe2
Instruction Fuzzy Hash: 3851C0B1D103099FDB14CF9AC984ADEBBB5BF48310F24852AE418AB254D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0660A898 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0660A9AA

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6765d9aeef82f7c883d4d3ec242c521fa306f64f790a7f6906777cc664249a1b
Instruction ID: 1a0196e5832dce182f50d9f141f8acb6bc359318089a031597c810386892ef6d
Opcode Fuzzy Hash: 6765d9aeef82f7c883d4d3ec242c521fa306f64f790a7f6906777cc664249a1b
Instruction Fuzzy Hash: 3041D0B1D103099FDB14CFDAC984ADEBBB5FF48310F24852AE818AB250D775A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0660E344 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0660F6E9

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d06a59ea40ed94a9ca978a906e2dfe1e8f7c6ada24861140106e63cab4d374c7
Instruction ID: c428e51b67065019a25c04377e333f448dc3daec2be6f4d69ace7993e47e5315
Opcode Fuzzy Hash: d06a59ea40ed94a9ca978a906e2dfe1e8f7c6ada24861140106e63cab4d374c7
Instruction Fuzzy Hash: 7E415AB5A00305DFDB58CF99C888AABBBF5FF88314F24C459D919A7360D734A841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E91C Relevance: 1.6, APIs: 1, Instructions: 79
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 00F8E9B0

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 766dce09004cf182a40ef3a91f5acfd0c8210aeb99cc227ee5cfa1f7e8ea119c
Instruction ID: f3ed7e863e72176a8a8e1876f0eee62382add46d978b3d42060d426df812d09d
Opcode Fuzzy Hash: 766dce09004cf182a40ef3a91f5acfd0c8210aeb99cc227ee5cfa1f7e8ea119c
Instruction Fuzzy Hash: 703123B0D01248DFDB14DFA9C985BDEBBF5BF48714F248019E504BB294CBB86885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E928 Relevance: 1.6, APIs: 1, Instructions: 71
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 00F8E9B0

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d6a525c3cac169cb3ae15e0170a896f220f2876918044de2f560f168d2778574
Instruction ID: 17fb807c7bd61408d40961711f892ec016cfdba5b17f3730ecc3f241df3eff37
Opcode Fuzzy Hash: d6a525c3cac169cb3ae15e0170a896f220f2876918044de2f560f168d2778574
Instruction Fuzzy Hash: 603100B0D01248DFDB14EF99C984BCDBBF5BF48714F248019E404BB294CBB8A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F87ECA Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00F87F47

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f81773926d76fbc7f9774aecefcabd3a98fc260a7e8358acdc07427813b903e2
Instruction ID: 2dc6727fc923277d6a05c4812bd635944d8ee383c86df71cf5613c67d99700ca
Opcode Fuzzy Hash: f81773926d76fbc7f9774aecefcabd3a98fc260a7e8358acdc07427813b903e2
Instruction Fuzzy Hash: 7B214AB18002598FDB10DF9AD484BEEBBF4EF49324F14846AE559B3350C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0660E790 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0660E81F

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab7274a6ae53fd416d1790fdcbc7cc5e8a39f0c1480aa3a36f3371790f309e4e
Instruction ID: 633ccad59aaf16598805bc387af8cd06a01e4a69ce5c6e7032ba673050d700da
Opcode Fuzzy Hash: ab7274a6ae53fd416d1790fdcbc7cc5e8a39f0c1480aa3a36f3371790f309e4e
Instruction Fuzzy Hash: 1821E9B5D01248AFDB10CFA9D984ADEBFF4FB48310F14841AE914A7350D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0660E798 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0660E81F

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 396c99896c67a02f431173b893eb9d0fe2793eadd40e4e5f93c647cb143b5af6
Instruction ID: f5ced993a82f9a943e79c1336287d8d7018908b2755513210095d8974177c0ff
Opcode Fuzzy Hash: 396c99896c67a02f431173b893eb9d0fe2793eadd40e4e5f93c647cb143b5af6
Instruction Fuzzy Hash: 6221C4B5D00259AFDB10CFAAD984ADEBFF4FB48310F14841AE918A3350D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 066097EA Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06609856

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 81fb4ded58b222718e1cd3fafc8b5aee1497fb26e2e528e04ee69e2574581dee
Instruction ID: 31457aa4fe78bafb08a474d36aa28e47130c9142c6b565eea49b781d030bc243
Opcode Fuzzy Hash: 81fb4ded58b222718e1cd3fafc8b5aee1497fb26e2e528e04ee69e2574581dee
Instruction Fuzzy Hash: 041123B5C002499EDB10CF9AD844ADEFBF8EF49310F10852AD419A7300C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06608308 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06609856

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d24accbe56b0fcdcbafbc4728c8ff3a97a57ae69d06d11c006630696c50b619b
Instruction ID: a57a7ace363722268c14e9cf0974e79c5e6b1e60f4de0948fbd662d141537b7f
Opcode Fuzzy Hash: d24accbe56b0fcdcbafbc4728c8ff3a97a57ae69d06d11c006630696c50b619b
Instruction Fuzzy Hash: 241120B6C002498FDB14DF9AD844ADEFBF5EB88314F10852AD919B7301C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0660E39C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0660F935), ref: 0660F9BF

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 56c447e842bd164ca08a99338f2b89ded7701c65d47834bdf37b326029b36023
Instruction ID: fb0eecf7ec8b14779238654f191b0d8812422c4780bc89e537b88583c91fb8dd
Opcode Fuzzy Hash: 56c447e842bd164ca08a99338f2b89ded7701c65d47834bdf37b326029b36023
Instruction Fuzzy Hash: 5B1136B58002488FDB60DF99D444B9EBBF4EB49324F20841AD919B3240C774A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E7D9 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 00F8E835

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4021d3b4cd018c478581b4a2dd913cb888dc66c66fced4113f25087e6baf094a
Instruction ID: fcac7d98afd5245f331d4df615c6301c978409678fed1e999daec4d71fa38dcd
Opcode Fuzzy Hash: 4021d3b4cd018c478581b4a2dd913cb888dc66c66fced4113f25087e6baf094a
Instruction Fuzzy Hash: 2E1115B5D002488FCB10DFAAD544BDEFFF4EB48324F248459D518A7210C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0660F958 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,0660F935), ref: 0660F9BF

Memory Dump Source

Source File: 00000004.00000002.4500165694.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6600000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 42d733c8b790a04edd0138b787be1a8fd8fed86ad96f4b01ff589db872569c68
Instruction ID: ab7fd6d065aab5c0a9867e4979c13805f2cc813fe8f06ecb6657df5229535ef1
Opcode Fuzzy Hash: 42d733c8b790a04edd0138b787be1a8fd8fed86ad96f4b01ff589db872569c68
Instruction Fuzzy Hash: CF1148B18002498FCB20DF99C444BDEFFF4EF49324F20841AD519A7240C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E7E0 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 00F8E835

Memory Dump Source

Source File: 00000004.00000002.4479775287.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f80000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 247a23c96d3f997e89f1c01ea7a5ec8d6cb4b159c832227ffdbf3b3a877d0857
Instruction ID: 5b2dd35a020d2310a38d555e392338b930255066f9f6d70af800e455d278e34f
Opcode Fuzzy Hash: 247a23c96d3f997e89f1c01ea7a5ec8d6cb4b159c832227ffdbf3b3a877d0857
Instruction Fuzzy Hash: EA11E2B59006488FCB20DF9AD549BDEBFF4EB48324F248459D518A7210C779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4476958604.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd38066480902fa044d9e9aad3366df995e4414f41f852f5f3f55e62a467ef4b
Instruction ID: 9e37f0128faba9492c2ffbb1c189ae28faf9fc5d414eacb0b59f108c44339cee
Opcode Fuzzy Hash: dd38066480902fa044d9e9aad3366df995e4414f41f852f5f3f55e62a467ef4b
Instruction Fuzzy Hash: D5316B7150D3C49FCB03CB24C994711BF71AB47214F29C5EBD9898F2A3C23A984ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4476958604.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_c1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16686f6682520f9601e2cef589636c58d942f8a5e4504504f63d3064baa93416
Instruction ID: 86a0d3662c146175a436c4bd9d6fe0416eebfa36d61f48b7b6042d7c3a64d835
Opcode Fuzzy Hash: 16686f6682520f9601e2cef589636c58d942f8a5e4504504f63d3064baa93416
Instruction Fuzzy Hash: 35212271504204DFCB14DF14D980B26BBA5EB89314F24C669D80A4B256C33AD886EA62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sZXuT60Q6P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sZXuT60Q6P.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2oeooidd.gzn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj3hruci.d22.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3oo04i5.rk3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rpol341l.nff.psm1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
sZXuT60Q6P.exe

Function 02933CF4 Relevance: 2.0, Strings: 1, Instructions: 743
COMMON

Function 0293B2D9 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 0293D7BC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0293DBC9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0293A668 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 0293B758 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 0293B4D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 04F9C138 Relevance: 1.4, Strings: 1, Instructions: 171
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre