Edit tour

Windows Analysis Report
hesaphareketi_1.scr.exe

Overview

General Information

Sample name:	hesaphareketi_1.scr.exe
Analysis ID:	1430777
MD5:	39c348d66f448c5dfd2ce92756a2af10
SHA1:	0e236d48df2f56db7c292c402c48e098c5526639
SHA256:	3a9444944c737900563b16dab76e19bcd2c52f1d3b35e258d581b523586ae828
Tags:	AgentTeslaexegeoscrTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi_1.scr.exe (PID: 4276 cmdline: "C:\Users\user\Desktop\hesaphareketi_1.scr.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

powershell.exe (PID: 3956 cmdline: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hesaphareketi_1.scr.exe (PID: 1988 cmdline: "C:\Users\user\Desktop\hesaphareketi_1.scr.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

svchost.exe (PID: 1152 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cbsBVT.exe (PID: 4152 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

powershell.exe (PID: 4276 cmdline: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cbsBVT.exe (PID: 4640 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

cbsBVT.exe (PID: 5296 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

cbsBVT.exe (PID: 5704 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

powershell.exe (PID: 2684 cmdline: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cbsBVT.exe (PID: 2300 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

cbsBVT.exe (PID: 1372 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

cbsBVT.exe (PID: 3040 cmdline: "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe" MD5: 39C348D66F448C5DFD2CE92756A2AF10)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "business29.web-hosting.com", "Username": "admin@purchase.boats", "Password": "Esupofo234@"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi_1.scr.exe PID: 4276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi_1.scr.exe PID: 4276	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi_1.scr.exe PID: 1988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi_1.scr.exe PID: 1988	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: cbsBVT.exe PID: 5296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cbsBVT.exe PID: 5296	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: cbsBVT.exe PID: 3040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cbsBVT.exe PID: 3040	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.cbsBVT.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.cbsBVT.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.cbsBVT.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33eb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fcd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34037:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3413f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341cf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi_1.scr.exe.4661450.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi_1.scr.exe.4661450.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi_1.scr.exe.4661450.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3203f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320b1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3213b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321cd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32237:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3233f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323cf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f26f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaa48f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33eb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f2e1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaa501:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f36b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaa58b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33fcd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f3fd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaa61d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34037:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f467:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaa687:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340a9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f4d9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaa6f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3413f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f56f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaa78f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xfb0df:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x13650f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x17172f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xfb151:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x136581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1717a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xfb1db:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x13660b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x17182b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xfb26d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x13669d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1718bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xfb2d7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x136707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x171927:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xfb349:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x136779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x171999:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xfb3df:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x13680f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x171a2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x14b70f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x186b3f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1c1d5f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14b781:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x186bb1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1c1dd1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x14b80b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x186c3b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1c1e5b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x14b89d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x186ccd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1c1eed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x14b907:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x186d37:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1c1f57:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x14b979:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x186da9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1c1fc9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14ba0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x186e3f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1c205f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\hesaphareketi_1.scr.exe, ProcessId: 1988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbsBVT

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 198.54.114.199, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\hesaphareketi_1.scr.exe, Initiated: true, ProcessId: 1988, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe', CommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi_1.scr.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi_1.scr.exe, ParentProcessId: 4276, ParentProcessName: hesaphareketi_1.scr.exe, ProcessCommandLine: "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe', ProcessId: 3956, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1152, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hesaphareketi_1.scr.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Avira: detection malicious, Label: HEUR/AGEN.1309721

Found malware configuration

Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "business29.web-hosting.com", "Username": "admin@purchase.boats", "Password": "Esupofo234@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Virustotal: Detection: 38%			Perma Link

Multi AV Scanner detection for submitted file

Source: hesaphareketi_1.scr.exe	ReversingLabs: Detection: 52%
Source: hesaphareketi_1.scr.exe	Virustotal: Detection: 38%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hesaphareketi_1.scr.exe

Joe Sandbox ML: detected

Source: hesaphareketi_1.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49717 version: TLS 1.2

Source: hesaphareketi_1.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: hesaphareketi_1.scr.exe, 00000000.00000002.1400527379.0000000005C20000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1396824751.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000006.00000002.1576509993.0000000003031000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000E.00000002.1661164916.0000000002A23000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb{+Ll0 source: powershell.exe, 0000000F.00000002.1710961806.000000000867F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbst.resources.dll source: powershell.exe, 00000007.00000002.1584908607.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb/: source: powershell.exe, 0000000F.00000002.1703052636.0000000007789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1409770708.00000000028E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1603996918.000000000762C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1422525987.000000000807F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1608334741.000000000861A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.1607940683.00000000085D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1703052636.00000000077EA000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 198.54.114.199:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 198.54.114.199:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://business29.web-hosting.com
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2669457268.0000000006A9B000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680523743.0000000006700000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2639002089.0000026D5AA00000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1584908607.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2666704343.000000000683F000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.1419457757.0000000007054000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi?
Source: cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microj
Source: svchost.exe, 00000005.00000002.2639002089.0000026D5AA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.1411676726.0000000004BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000005214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000002.00000002.1416322622.00000000054D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1599751140.0000000005B36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2669457268.0000000006A9B000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680523743.0000000006700000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0-
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1411676726.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004C22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1411676726.0000000004471000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.0000000004F71000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1411676726.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004C22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000002.00000002.1411676726.0000000004471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.1397280494.0000026D5AC20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1400665428.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/sam210723/goesrecv-monitor/releases/latest
Source: powershell.exe, 00000002.00000002.1416322622.00000000054D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1599751140.0000000005B36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1400665428.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vksdr.com/goesrecv-monitor
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1395292629.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wdcp.mi

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49717 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, cPKWk.cs

.Net Code: f0r

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.cbsBVT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_01A2CD3C	0_2_01A2CD3C
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_01A2F5B6	0_2_01A2F5B6
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_01A2F5B8	0_2_01A2F5B8
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_059D7718	0_2_059D7718
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_059DCF50	0_2_059DCF50
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_059DCF3F	0_2_059DCF3F
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030A4B10	4_2_030A4B10
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030A3EF8	4_2_030A3EF8
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030A4240	4_2_030A4240
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030ACC98	4_2_030ACC98
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030ACCA8	4_2_030ACCA8
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_07084078	4_2_07084078
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_07094E20	4_2_07094E20
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0709CE58	4_2_0709CE58
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0709A680	4_2_0709A680
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0709B6C8	4_2_0709B6C8
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0709ADD0	4_2_0709ADD0
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_07097440	4_2_07097440
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_070919E8	4_2_070919E8
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0709C778	4_2_0709C778
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_07091A99	4_2_07091A99
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 6_2_0121CD3C	6_2_0121CD3C
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 6_2_0121F5A8	6_2_0121F5A8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 6_2_0121F5B8	6_2_0121F5B8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013CA588	11_2_013CA588
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013C4B10	11_2_013C4B10
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013CEB90	11_2_013CEB90
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013CAE10	11_2_013CAE10
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013C3EF8	11_2_013C3EF8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013C4240	11_2_013C4240
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C5A8D4	11_2_06C5A8D4
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C5A5B4	11_2_06C5A5B4
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C5C058	11_2_06C5C058
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C5DC10	11_2_06C5DC10
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C72760	11_2_06C72760
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C765E0	11_2_06C765E0
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C7C580	11_2_06C7C580
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C75598	11_2_06C75598
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C7B230	11_2_06C7B230
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C77D70	11_2_06C77D70
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C77690	11_2_06C77690
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C7E798	11_2_06C7E798
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C70040	11_2_06C70040
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C75CE8	11_2_06C75CE8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_071E3500	11_2_071E3500
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_06C70007	11_2_06C70007
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 14_2_00FB4560	14_2_00FB4560
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 14_2_00FBCD3C	14_2_00FBCD3C
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 14_2_00FBF5B8	14_2_00FBF5B8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 14_2_00FBF5A8	14_2_00FBF5A8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D6EAA9	19_2_02D6EAA9
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D64B10	19_2_02D64B10
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D63EF8	19_2_02D63EF8
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D64240	19_2_02D64240
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D6AD50	19_2_02D6AD50
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D5A8D4	19_2_06D5A8D4
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D5A5B4	19_2_06D5A5B4
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D5DC10	19_2_06D5DC10
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D73460	19_2_06D73460
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D7B21F	19_2_06D7B21F
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D77690	19_2_06D77690
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D7E798	19_2_06D7E798
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D70040	19_2_06D70040
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D70006	19_2_06D70006
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_07123500	19_2_07123500
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D7003B	19_2_06D7003B

Source: hesaphareketi_1.scr.exe, 00000000.00000002.1400527379.0000000005C20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396824751.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396824751.00000000034F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2379f9fe-9543-4c0b-b671-f5490ed118f9.exe4 vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1395292629.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2379f9fe-9543-4c0b-b671-f5490ed118f9.exe4 vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000000.1378076626.000000000102C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStorages.exe2 vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000000.00000002.1400665428.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamegoesrecv.dllB vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2633683375.0000000001359000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs hesaphareketi_1.scr.exe
Source: hesaphareketi_1.scr.exe	Binary or memory string: OriginalFilenameStorages.exe2 vs hesaphareketi_1.scr.exe

Source: hesaphareketi_1.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.cbsBVT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: hesaphareketi_1.scr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cbsBVT.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.hesaphareketi_1.scr.exe.5db0000.6.raw.unpack, ConstellationPanel.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.hesaphareketi_1.scr.exe.5db0000.6.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD
Source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, Symbols.cs	Base64 encoded string: 'xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818=', 'kcUEXaQPPIwtVFtC1PL/HXXkxfIZB03eNHvJetoP4hJTCBXd428OqcdPbPWqvhIczQvj71Ac6LZ7OG/e+yr4Bxet9vqIWevSzbdwqqWPf8nK2cPiNSfXdemqzBs1kBKEGQlnxKecRQs0Fim2Dq/kkqqyy4FT/M/7aleIZqMCZ4mq5jKj7zWHx8js/y7INNJykRnbqqkNJse2whyml6+Dho8xXhyKKjEjHHCQ++yYATPvU+ZwZGQ1aiyg3xM2+Mufv6OdiWo+NL8qVblSY+ML74QQ3+qn2cEZW8xaJcMAsMta6fJiSREwzJ1z86EfJ/jsm5waxGaL/ovb6ftrSW+RglFtTXsgBL0RqWZpQItqPDkF2hues0c5OGEtzNWaUVXn+H8FUCAJ+aqWE9AG5vtPYKXmrSZj5IG/6FHSIYC0nWBx5wHsGRTyzUgkPZMLeX0qotsCm9lMlGpxKlh+Z1oic1vbrF8QbV1eNo4t2Pb5oYAk/LIRoTnuPlLXjaubmL1hSqvzPQ/sVXzd5mXTvaOq58aApZHbOXkjfhfbDwVLc3Bjs25RTwPrIWsIAKwX/3kGBu/AxMY0Wb07NTJmloyghXyX9HTSpFE3N+D/N7l3tVWX/n6tnybXZUsRqFSB6rG1tbIR1a+4GVp+//5BqD3kM0VXcBGmG3xpyDSDCLIVVEXY5GyYN1vEkdGhjGvmeOX02f1RKB3vh5V5M5RcsEYhGsS36zuGpaNhrGf4h+7HDzTIU9/1Xl1nPdFaQmDFTIiidpmn26+9CW+g2SPIPlPDTjgkYnTmXT+O8PHwjD7K5IOwDZUbbAFA1Lrdc9IlU412XoEdl5mDZkue1zwbLWf+qvNJbFX8sXHehpGS3HbJZGQqyBs/WGnME/zTep7mu3SAbJ/9lw9DubLAWm3eZ/MVjBNuE3yDINYwtRQMJcyCjqvOUaWeWaIkvESwPYK4f4DzXPSa187wG+9AlgF8f2wQOygxX1dsc+xQUYb6mjfKphwvQfA49LiS6QNKSqz15qqR0H8SkeLLJ7txSyPf5o/Vb8ElYF2R/Dsozjt09H5PLZg8Mx42byNjie81RXixtgWQpr4xblQ9zxj5IaMqOBw3U6yvkKqUNQd1pRUx/33LazNTVFgHRwpx+LutF/m3Ilc9LDSXQ2sLYadTLNM4H6sg88B3Ku0bJgNkN8dFdIsCjQkk9Mdt0ps7+1BSph400PLXGB8Ouast6dmU+lpkXpEGr/mWHaX4VEifmt6MFtiG9jSUTjA2VqhJ2qS66jKrnf1CuWF5qWbXjRlBXUK1jLibI8Is03eHlVAWQOFZcrfOpPq3o0OxUDbCLddsIsPCScNdGrBY2q9RllmuBZNg/W6T5m+X2KNwjQyVBQxBU34LaUg9GMhx5G6e5/2Gji8UiH7/fu4jgyKbpw9r0egwJJndmdSHGUdUQ49W56s9vPelsDJb08XuAjWQXFOdA1Kmsw9Dh45XsM/m10+4XbpvyJ7XmTYJAvhQMXLFqtS4GpKG69JRuO4n+L6rSLGlFzxmsEhm3QM9iDYz2US4Un+EjCOwvFtl/eeSBED1CLnNZf4IbflrasiyFM6IFES8MG62FqpfoichpMq3Dt3tPmAgGD89QmkCsMCq8pGj+3BeDc98BauK1JlOc3iObuBFb0NChpfWa1lZmLvdMib+Wp2pqytptC5Ad7o8p4gSVACx6up/YNr6I8YhsqGIHpFV7Jvk6nzQ19vdCSYcUt+o2i12lPTyUqO5WujSq7P41U0w2rtJQ26/ZzkoCHMKUckEWvk2ei4A+bBCG2520B3/6O1EclfvsvlFIIf2mfft+6FFGP8enxtpFqG/1EAjM3sSS6IKARWsy3s4D5H+dtzPSaR/PDr2jejgFGRPxSbuLutKf4Kq55+afwF989Ad3WDqFcnmc5BwJhXFPxqlmhbPFSMnMVSksaW8UAhMCwLnt31FSm9CfeXXjCj8+hrMcPtn4+PDQeiLyf5/nD/vwOnFGKuLEm9JR/FzB5RktFNWqSYEqRzg8LgsYcEHc4zWyBiABM1LbR2nzax5QE3aZASIx1za/lqdqTVimq7MZbrwQrWQinziaucgzSHxKw880yNElAHNJZFw5Z4rZRzj/oK/kMoAhV4H1jnZbSuePHvddP24l9YOvlGpCsWrI3fk7BWzD8DJD3X2bGim8xoEt4g/R1aCZC/UMvPk/1IixbWw1P+li3OayxAQlbUqmb7DPHGvkbTD8evGdp3QwQWtGkbPRmu+iUWIEefvCP02tcFiIPdm82jN+Oc7+krSiRmxMiJMVt8h+1THUxoF3qD

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/20@2/3

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File created: C:\Users\user\AppData\Roaming\cbsBVT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2768:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fllulnlq.3yr.ps1

Jump to behavior

Source: hesaphareketi_1.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi_1.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi_1.scr.exe	ReversingLabs: Detection: 52%
Source: hesaphareketi_1.scr.exe	Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File read: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi_1.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi_1.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: hesaphareketi_1.scr.exe, 00000000.00000002.1400527379.0000000005C20000.00000004.08000000.00040000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1396824751.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000006.00000002.1576509993.0000000003031000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000E.00000002.1661164916.0000000002A23000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb{+Ll0 source: powershell.exe, 0000000F.00000002.1710961806.000000000867F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbst.resources.dll source: powershell.exe, 00000007.00000002.1584908607.0000000002FAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb/: source: powershell.exe, 0000000F.00000002.1703052636.0000000007789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1409770708.00000000028E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1603996918.000000000762C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.1422525987.000000000807F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1608334741.000000000861A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000007.00000002.1607940683.00000000085D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1703052636.00000000077EA000.00000004.00000020.00020000.00000000.sdmp

Source: hesaphareketi_1.scr.exe

Static PE information: 0xDE088ED3 [Fri Jan 16 14:46:43 2088 UTC]

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 0_2_059DE6AF push 5D01A556h; ret	0_2_059DE660
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_030A0CB5 push edi; ret	4_2_030A0CC2
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Code function: 4_2_0708244F push es; ret	4_2_07082460
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04A442B8 push ebx; ret	7_2_04A442DA
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 11_2_013C0CB5 push edi; ret	11_2_013C0CC2
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D60C93 push edi; retf	19_2_02D60C3A
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_02D60CB5 push edi; ret	19_2_02D60CC2
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D55178 push es; ret	19_2_06D55170
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D55162 push es; ret	19_2_06D55170
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D7805B push ebp; iretd	19_2_06D7805E
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D741F7 push ss; iretd	19_2_06D741FA
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D741FB push ss; iretd	19_2_06D74202
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D79131 push 65A806CFh; iretd	19_2_06D79136
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D72EDF push cs; iretd	19_2_06D73452
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D77D70 push esi; iretd	19_2_06D7805A
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D77D67 push edx; iretd	19_2_06D77D6A
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D77D60 push edx; iretd	19_2_06D77D66
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D78A08 pushad ; iretd	19_2_06D78A0E
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_06D748E1 push ds; iretd	19_2_06D748E2
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Code function: 19_2_071211B0 push es; ret	19_2_071211C0

Source: hesaphareketi_1.scr.exe	Static PE information: section name: .text entropy: 7.933213587645533
Source: cbsBVT.exe.4.dr	Static PE information: section name: .text entropy: 7.933213587645533

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Jump to dropped file

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cbsBVT			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cbsBVT			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

File opened: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 19E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 34F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 3410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 3140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Memory allocated: 5140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 1210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 3030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 13C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 16A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 4920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 2F10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Memory allocated: 4F10000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6398	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3132	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Window / User API: threadDelayed 3906	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Window / User API: threadDelayed 995	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7316	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2099	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Window / User API: threadDelayed 1241
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Window / User API: threadDelayed 3231
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7488
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2056
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Window / User API: threadDelayed 1958
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Window / User API: threadDelayed 2520

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep count: 6398 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5084	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5812	Thread sleep count: 3132 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99104s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98447s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -98095s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -97421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe TID: 1840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3228	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 4824	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3840	Thread sleep count: 7316 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep count: 2099 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 1440	Thread sleep count: 1241 > 30
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 1440	Thread sleep count: 3231 > 30
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99764s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99652s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99434s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98779s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98670s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98344s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98234s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98125s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -98015s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -97906s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -97797s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 2328	Thread sleep time: -97687s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 5176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep count: 7488 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5432	Thread sleep count: 2056 > 30
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 3828	Thread sleep count: 1958 > 30
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99778s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 3828	Thread sleep count: 2520 > 30
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99669s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -99095s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98968s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98859s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98745s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98617s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98507s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98390s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98281s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98172s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -98059s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -97952s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -97843s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -97734s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -97625s >= -30000s
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe TID: 736	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99217	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99104	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98447	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 98095	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97749	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 97421	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99764
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99652
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99434
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98779
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98670
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98344
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98234
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98125
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98015
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97906
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97797
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97687
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99778
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99669
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 99095
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98968
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98859
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98745
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98617
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98507
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98390
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98281
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98172
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 98059
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97952
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97843
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97734
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 97625
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000005.00000002.2639144289.0000026D5AA58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2637323659.0000026D5562B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.hesaphareketi_1.scr.exe.35f3aec.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: MyGetProcAddress(hProcess, Name)
Source: 0.2.hesaphareketi_1.scr.exe.35f3aec.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: LoadLibraryA(ref name)
Source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Memory written: C:\Users\user\Desktop\hesaphareketi_1.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process created: C:\Users\user\Desktop\hesaphareketi_1.scr.exe "C:\Users\user\Desktop\hesaphareketi_1.scr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe "C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\hesaphareketi_1.scr.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\appdata\roaming\cbsbvt\cbsbvt.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\appdata\roaming\cbsbvt\cbsbvt.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\desktop\hesaphareketi_1.scr.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\appdata\roaming\cbsbvt\cbsbvt.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" ??????????-??????????e??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????p??????????o??????????l??????????i??????????c??????????y?????????? ??????????b??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????c?????????o?????????p?????????y?????????-?????????i?????????t?????????e?????????m 'c:\users\user\appdata\roaming\cbsbvt\cbsbvt.exe' 'c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\.exe'

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi_1.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi_1.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 11.2.cbsBVT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 3040, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 11.2.cbsBVT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 3040, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 11.2.cbsBVT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4661450.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.459a1b0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi_1.scr.exe.4549b80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 4276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi_1.scr.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cbsBVT.exe PID: 3040, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hesaphareketi_1.scr.exe	53%	ReversingLabs	Win32.Spyware.Negasteal
hesaphareketi_1.scr.exe	39%	Virustotal		Browse
hesaphareketi_1.scr.exe	100%	Avira	HEUR/AGEN.1309721
hesaphareketi_1.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	100%	Avira	HEUR/AGEN.1309721
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	53%	ReversingLabs	Win32.Spyware.Negasteal
C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe	39%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://crl.mi?	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0-	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://vksdr.com/goesrecv-monitor	0%	Avira URL Cloud	safe
http://crl.microj	0%	Avira URL Cloud	safe
https://wdcp.mi	0%	Avira URL Cloud	safe
https://vksdr.com/goesrecv-monitor	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
business29.web-hosting.com	198.54.114.199	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1416322622.00000000054D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1599751140.0000000005B36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0-	hesaphareketi_1.scr.exe, 00000004.00000002.2636111594.000000000164E000.00000004.00000020.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1657051554.0000000001490000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2633915220.0000000001234000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://account.dyn.com/	hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.1411676726.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004C22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.2639002089.0000026D5AA00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000005.00000003.1397280494.0000026D5AC20000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false		high
https://api.ipify.org/t	hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/sam210723/goesrecv-monitor/releases/latest	hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1400665428.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000002.00000002.1411676726.0000000004BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000005214000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1672956754.000000000324F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.5.dr	false		high
https://api.ipify.org	hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microj	cbsBVT.exe, 0000000B.00000002.1680830301.0000000006756000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.1411676726.0000000004471000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mi?	powershell.exe, 00000002.00000002.1419457757.0000000007054000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://business29.web-hosting.com	hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vksdr.com/goesrecv-monitor	hesaphareketi_1.scr.exe, 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000000.00000002.1400665428.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.1411676726.00000000045C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004C22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.00000000050C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1416322622.00000000054D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1599751140.0000000005B36000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1697267398.0000000005FD7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wdcp.mi	hesaphareketi_1.scr.exe, 00000000.00000002.1395292629.0000000001623000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1411676726.0000000004471000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi_1.scr.exe, 00000004.00000002.2641024996.0000000003141000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1588730202.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 0000000B.00000002.1662306646.000000000312C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1679690872.0000000004F71000.00000004.00000800.00020000.00000000.sdmp, cbsBVT.exe, 00000013.00000002.2639565652.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.54.114.199	business29.web-hosting.com	United States		22612	NAMECHEAP-NETUS	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430777
Start date and time:	2024-04-24 07:10:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi_1.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/20@2/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 270 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.202.57.177
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3956 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4276 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:11:11	API Interceptor	61x Sleep call for process: powershell.exe modified
07:11:12	API Interceptor	2x Sleep call for process: svchost.exe modified
07:11:17	API Interceptor	24x Sleep call for process: hesaphareketi_1.scr.exe modified
07:11:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cbsBVT C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
07:11:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cbsBVT C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
07:11:32	API Interceptor	44x Sleep call for process: cbsBVT.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.54.114.199	http://duckyblogs.com/2022/08/30/keith-cederholm-barn	Get hash	malicious	Unknown	Browse	duckyblogs.com/2022/08/30/keith-cederholm-barn
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
business29.web-hosting.com	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
business29.web-hosting.com	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
api.ipify.org	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.Python.Stealer.1437.14994.32063.exe	Get hash	malicious	Python Stealer	Browse	172.67.74.152
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	CR-FEDEX_TN-775720741041.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	copy#10476235.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Payment MT103.xls	Get hash	malicious	Unknown	Browse	104.21.15.201
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	New Order .doc	Get hash	malicious	Unknown	Browse	172.67.134.136
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
NAMECHEAP-NETUS	181_960.msi	Get hash	malicious	Unknown	Browse	199.192.27.64
	232_786.msi	Get hash	malicious	Unknown	Browse	199.192.27.64
	m2 Cotizaci#U00f3n-1634.pdf.exe	Get hash	malicious	FormBook	Browse	198.54.117.242
	Job Application.pdf.lnk	Get hash	malicious	Unknown	Browse	162.0.236.151
	PO_PDF24172024.scr.exe	Get hash	malicious	FormBook	Browse	37.61.232.138
	eInvoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	185.61.152.60
	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
	Remittance slip.vbs	Get hash	malicious	Unknown	Browse	185.61.152.60
	hesaphareketi_1.SCR.exe	Get hash	malicious	AgentTesla	Browse	198.54.114.199
	Payment Advice for Invoice 2024 0904.vbs	Get hash	malicious	FormBook	Browse	185.61.152.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205
	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	Zapytanie ofertowe (7427-23 ROCKFIN).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Factura240413227178.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	JUSTIFICANTE DE PAGO.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021744339108811
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAS:RJE+Lfki1GjHwU/+vVhWqpn
MD5:	0D4F863CB6FE3D8A0F99234DB8DE1734
SHA1:	08F6883194DA6E71B370E59A1190B9184B480BB8
SHA-256:	3A5434E28C86ABA21B564ACDF4C0D32FA6ADDC09CD0566AC6C1C5473A5B0CA26
SHA-512:	412E703BB6AC0E268E07BAD2F023AC3082025FE4FE20C2C537BA1772455606F4DB97057BE2AB1543103723D4C7CA60B439B400E2A0E5A10C30DDBE5EA3D2134E
Malicious:	false
Reputation:	low
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5240ef93, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432590994172936
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	846162F0E4E8625E30F091316D90E696
SHA1:	E72C572ADC2F9D95E64DDB9910D13DBE97FD61F3
SHA-256:	38BDD97DD63EB06592A814596CEF1C3F18323CA61BCF1FC6533DF5124599B33B
SHA-512:	95971204C048028A0C99406CC458B511856F344B70438FEBF9A68C80ED0006E6F363A215F0592A621E3366EAF4146677FD98206DB699FA7E2056840A8785CE0B
Malicious:	false
Reputation:	low
Preview:	R@.... ...............X\...;...{......................0.x...... ...{s......\|_.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................-........\|...................i,,.....\|_..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07995755026283656
Encrypted:	false
SSDEEP:	3:pXKYeflhFl/nqlFcl1ZUllllozsEillGBnX/l/Tj/k7/t:pXKzflhFl/qlFclQ/lfh254
MD5:	2C8DEA6038B1AF7086073C0DC2D76D5D
SHA1:	7ED1CEC7D102EABE8B2E02B6BBB47A7C6DF85374
SHA-256:	E16DDB6C0B83BC7FBD24CFF4333261C0F75D73B607981D69DA8D82E395BB1DB7
SHA-512:	5BDACB09529D373F265F559E333311B1C761BB09A6726DD93B934897F4754C2F4C3EC4D0526F42A2330AAEE3A9644802BCBE12ACD37A3C473DB96AF952867498
Malicious:	false
Reputation:	low
Preview:	h:N......................................;...{.......\|_.. ...{s.......... ...{s.. ...{s.P.... ...{s..................i,,.....\|_.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cbsBVT.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ch0lgdmz.2ec.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cle1hxl3.tk0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eckwbzzv.zhy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fllulnlq.3yr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fowbeh4v.1ik.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvaj1xj5.uha.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdbheqwd.wwo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kg4hvtwm.cu1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lfpezawh.b3z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nucdcpkm.i3z.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa4ndqpe.fl1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tz3wjugj.kkm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Download File

Process:	C:\Users\user\Desktop\hesaphareketi_1.scr.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	375296
Entropy (8bit):	7.922698401047371
Encrypted:	false
SSDEEP:	6144:JAHFQafd9O1S/jS4BwnvTB1QJgFmsDnv/snE2GUu6d7kxzjE2:+zd9OwGu+FmsDvQ9GHj
MD5:	39C348D66F448C5DFD2CE92756A2AF10
SHA1:	0E236D48DF2F56DB7C292C402C48E098C5526639
SHA-256:	3A9444944C737900563B16DAB76E19BCD2C52F1D3B35E258D581B523586AE828
SHA-512:	B01F7E6B47860F7687508F6FBD443923B5E782FB0D006EFF78898B30610811442B41495183B2B8A48FC235175FC50B588F19F3E4176B8C9D91C1CC85D69DC68C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53% Antivirus: Virustotal, Detection: 39%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0......,......^.... ........@.. ....................... ............@.....................................S.......4)........................................................................... ............... ..H............text...d.... ...................... ..`.rsrc...4).........................@..@.reloc..............................@..B................@.......H........b...G..........$[.............................................................?.......?.......?.......?.....^..9...U..............?...?...?...?2.{....o....2.{....o....:.{.....o$...&J.{.....o%...{....N.s)...}.....(.....s.........".(+....:.{.....{....Y^.(+.......}......}....&...}....~.(+......s~...}.....s~...}....n..{.....o......{....o.....j..{....o......{....o........j}".... ....j}#....s....}$....(........jo........j}".... ....j}#....s....}$....(.......

C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\hesaphareketi_1.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.922698401047371
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	hesaphareketi_1.scr.exe
File size:	375'296 bytes
MD5:	39c348d66f448c5dfd2ce92756a2af10
SHA1:	0e236d48df2f56db7c292c402c48e098c5526639
SHA256:	3a9444944c737900563b16dab76e19bcd2c52f1d3b35e258d581b523586ae828
SHA512:	b01f7e6b47860f7687508f6fbd443923b5e782fb0d006eff78898b30610811442b41495183b2b8a48fc235175fc50b588f19f3e4176b8c9d91c1cc85d69dc68c
SSDEEP:	6144:JAHFQafd9O1S/jS4BwnvTB1QJgFmsDnv/snE2GUu6d7kxzjE2:+zd9OwGu+FmsDvQ9GHj
TLSH:	5684E0736F849659DE9C2D39FC9E396EC2E91AE752D3FB24C67080819871320644FE4A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0......,......^.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	8f414a4c4c42c14f

Static PE Info

General

Entrypoint:	0x45aa5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDE088ED3 [Fri Jan 16 14:46:43 2088 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5aa08	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x2934	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x58a64	0x58c00	eb863bcf2c6cdc9463561948c51bd090	False	0.8962037852112676	data	7.933213587645533	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5c000	0x2934	0x2a00	24f47933c162da946a3b948bf515ace2	False	0.8600260416666666	data	7.706116452501856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60000	0xc	0x200	4d668a27bd82553824793373eb6e80f9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x5c130	0x22e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9471622075450576
RT_GROUP_ICON	0x5e418	0x14	data	0.95
RT_VERSION	0x5e42c	0x31c	data	0.4258793969849246
RT_MANIFEST	0x5e748	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:11:14.688350916 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:14.688409090 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:14.688517094 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:14.697738886 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:14.697757959 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.032953978 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.033092976 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:15.038858891 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:15.038866997 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.039170980 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.084393024 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:15.127413034 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:15.168116093 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.465729952 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.465797901 CEST	443	49707	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:15.466263056 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:15.472546101 CEST	49707	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:18.600857973 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:18.767726898 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:18.769077063 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.129461050 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.129673958 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.295943975 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.296149969 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.465219975 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.465641975 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.650780916 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.650816917 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.650866985 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.650896072 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.650909901 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.650947094 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.654012918 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.679406881 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:19.845840931 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:19.849483967 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.015453100 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.016767979 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.183032990 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.184181929 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.369147062 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.369406939 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.535065889 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.535325050 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.741591930 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.742620945 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.742815018 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.908637047 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.908655882 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:20.909312010 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.909392118 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.909404039 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:20.909435987 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:21.074914932 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:21.075067043 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:21.075820923 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:21.095396042 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:21.146773100 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:32.025676966 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.025732040 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.025814056 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.029042959 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.029078007 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.364981890 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.365077019 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.370682001 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.370698929 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.371032000 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.443900108 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.488121033 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.820672035 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.820758104 CEST	443	49713	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:32.821021080 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:32.823256016 CEST	49713	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:33.381782055 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:33.547837019 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:33.549175024 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:33.791553974 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:33.791987896 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:33.958271980 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:33.958501101 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.125446081 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.129651070 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.311959982 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.311981916 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.311995029 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.312015057 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.312094927 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.314519882 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.315927029 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.481990099 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.486468077 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.652343988 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.652757883 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:34.825877905 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:34.826299906 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.006762981 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.007055044 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.177738905 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.179270029 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.379748106 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.379954100 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.546979904 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.547617912 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.547722101 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.547722101 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.547722101 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:35.713555098 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.713573933 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.713701010 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.713826895 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.738240957 CEST	587	49715	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:35.787431002 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:40.084805965 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.084882021 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.084969997 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.089024067 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.089082956 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.418911934 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.418993950 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.421153069 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.421168089 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.421473026 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.474994898 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.485888958 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.532114983 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.891135931 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.891210079 CEST	443	49717	104.26.13.205	192.168.2.8
Apr 24, 2024 07:11:40.891380072 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:40.893866062 CEST	49717	443	192.168.2.8	104.26.13.205
Apr 24, 2024 07:11:41.434509039 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:41.600569010 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:41.600821972 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:41.925139904 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:41.925328016 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.091413975 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.091598988 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.258861065 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.259398937 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.437243938 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.437267065 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.437283993 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.437304020 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.437319994 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.437422991 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.439768076 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.445679903 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.611695051 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.616499901 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.782506943 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.782994032 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:42.959914923 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:42.960370064 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.105247974 CEST	49715	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.146295071 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.146539927 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.312306881 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.312613010 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.492047071 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.492377043 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.658749104 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.659390926 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.659497976 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.659497976 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.659497976 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:11:43.824948072 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.825042009 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.825261116 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.826299906 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.832256079 CEST	587	49718	198.54.114.199	192.168.2.8
Apr 24, 2024 07:11:43.881222010 CEST	49718	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:12:58.444061995 CEST	49709	587	192.168.2.8	198.54.114.199
Apr 24, 2024 07:12:58.611929893 CEST	587	49709	198.54.114.199	192.168.2.8
Apr 24, 2024 07:12:58.612668991 CEST	49709	587	192.168.2.8	198.54.114.199

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:11:14.517535925 CEST	57085	53	192.168.2.8	1.1.1.1
Apr 24, 2024 07:11:14.672370911 CEST	53	57085	1.1.1.1	192.168.2.8
Apr 24, 2024 07:11:18.423459053 CEST	52435	53	192.168.2.8	1.1.1.1
Apr 24, 2024 07:11:18.597352982 CEST	53	52435	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 07:11:14.517535925 CEST	192.168.2.8	1.1.1.1	0x8f94	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:11:18.423459053 CEST	192.168.2.8	1.1.1.1	0xb884	Standard query (0)	business29.web-hosting.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 07:11:14.672370911 CEST	1.1.1.1	192.168.2.8	0x8f94	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:11:14.672370911 CEST	1.1.1.1	192.168.2.8	0x8f94	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:11:14.672370911 CEST	1.1.1.1	192.168.2.8	0x8f94	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:11:18.597352982 CEST	1.1.1.1	192.168.2.8	0xb884	No error (0)	business29.web-hosting.com	198.54.114.199	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.26.13.205	443	1988	C:\Users\user\Desktop\hesaphareketi_1.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:11:15 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-24 05:11:15 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:11:15 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87939770ab160fcc-LAX
2024-04-24 05:11:15 UTC	13	IN	Data Raw: 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 Data Ascii: 154.16.105.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49713	104.26.13.205	443	5296	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:11:32 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-24 05:11:32 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:11:32 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 879397dcfc057c2f-LAX
2024-04-24 05:11:32 UTC	13	IN	Data Raw: 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 Data Ascii: 154.16.105.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	104.26.13.205	443	3040	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:11:40 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-24 05:11:40 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 05:11:40 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8793980f5d7b102c-LAX
2024-04-24 05:11:40 UTC	13	IN	Data Raw: 31 35 34 2e 31 36 2e 31 30 35 2e 33 36 Data Ascii: 154.16.105.36

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 24, 2024 07:11:19.129461050 CEST	587	49709	198.54.114.199	192.168.2.8	220-business29.web-hosting.com ESMTP Exim 4.96.2 #2 Wed, 24 Apr 2024 01:11:19 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 07:11:19.129673958 CEST	49709	587	192.168.2.8	198.54.114.199	EHLO 724471
Apr 24, 2024 07:11:19.295943975 CEST	587	49709	198.54.114.199	192.168.2.8	250-business29.web-hosting.com Hello 724471 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 24, 2024 07:11:19.296149969 CEST	49709	587	192.168.2.8	198.54.114.199	STARTTLS
Apr 24, 2024 07:11:19.465219975 CEST	587	49709	198.54.114.199	192.168.2.8	220 TLS go ahead
Apr 24, 2024 07:11:33.791553974 CEST	587	49715	198.54.114.199	192.168.2.8	220-business29.web-hosting.com ESMTP Exim 4.96.2 #2 Wed, 24 Apr 2024 01:11:33 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 07:11:33.791987896 CEST	49715	587	192.168.2.8	198.54.114.199	EHLO 724471
Apr 24, 2024 07:11:33.958271980 CEST	587	49715	198.54.114.199	192.168.2.8	250-business29.web-hosting.com Hello 724471 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 24, 2024 07:11:33.958501101 CEST	49715	587	192.168.2.8	198.54.114.199	STARTTLS
Apr 24, 2024 07:11:34.125446081 CEST	587	49715	198.54.114.199	192.168.2.8	220 TLS go ahead
Apr 24, 2024 07:11:41.925139904 CEST	587	49718	198.54.114.199	192.168.2.8	220-business29.web-hosting.com ESMTP Exim 4.96.2 #2 Wed, 24 Apr 2024 01:11:41 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 24, 2024 07:11:41.925328016 CEST	49718	587	192.168.2.8	198.54.114.199	EHLO 724471
Apr 24, 2024 07:11:42.091413975 CEST	587	49718	198.54.114.199	192.168.2.8	250-business29.web-hosting.com Hello 724471 [154.16.105.36] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Apr 24, 2024 07:11:42.091598988 CEST	49718	587	192.168.2.8	198.54.114.199	STARTTLS
Apr 24, 2024 07:11:42.258861065 CEST	587	49718	198.54.114.199	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	07:11:11
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\hesaphareketi_1.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi_1.scr.exe"
Imagebase:	0xfd0000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1396974953.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:11:11
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\Desktop\hesaphareketi_1.scr.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
Imagebase:	0x1f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:11:11
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:11:12
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\hesaphareketi_1.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi_1.scr.exe"
Imagebase:	0xf60000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2641024996.00000000031BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2641024996.0000000003191000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2641024996.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:11:12
Start date:	24/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:11:26
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0xc80000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs Detection: 39%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:11:28
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
Imagebase:	0x1f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:11:28
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:11:29
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0x80000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:11:29
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0xd60000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1662306646.000000000319C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1662306646.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1662306646.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1650972746.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:11:36
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0x600000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:11:37
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"Powershell.exe" ??????????-??????????E??????????x??????????e??????????c??????????u??????????t??????????i??????????o??????????n??????????P??????????o??????????l??????????i??????????c??????????y?????????? ??????????B??????????y??????????p??????????a??????????s??????????s?????????? ??????????-??????????c??????????o??????????m??????????m??????????a??????????n??????????d ?????????C?????????o?????????p?????????y?????????-?????????I?????????t?????????e?????????m 'C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
Imagebase:	0x1f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 2672, Parent PID: 2684

General

Target ID:	16
Start time:	07:11:37
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:11:38
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0x1b0000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:11:38
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0xb0000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:11:38
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\cbsBVT\cbsBVT.exe"
Imagebase:	0xd20000
File size:	375'296 bytes
MD5 hash:	39C348D66F448C5DFD2CE92756A2AF10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2639565652.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2639565652.0000000002F94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.2639565652.0000000002F61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	112
Total number of Limit Nodes:	9

Executed Functions

Function 059DCF50 Relevance: 1.8, Strings: 1, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 059DD69E

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 342cbe5c5214b0261ac7120ade7b85711ffcd6fcee85c652f4627d8ac13b2bcd
Instruction ID: c784e8bb64db61c380d41a69b7b2e822541c99a7b4083231121d5ecf6a372e65
Opcode Fuzzy Hash: 342cbe5c5214b0261ac7120ade7b85711ffcd6fcee85c652f4627d8ac13b2bcd
Instruction Fuzzy Hash: 5652BE75E012298FDB68DF65C894BDDBBB6BB89300F1081E9D40DA7290DB356E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059D7718 Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e081609c220e5a787c2a3297efd9f0b673c85039299d7b145e1fd46ca9453f4f
Instruction ID: 8e6fb5c69d39fce0cb07669d6226c62bf78cd45be5d01fa45f68a057ea4b6015
Opcode Fuzzy Hash: e081609c220e5a787c2a3297efd9f0b673c85039299d7b145e1fd46ca9453f4f
Instruction Fuzzy Hash: DB626035A042159FDB18DFA8C984AADB7B6FF88710F15C169E806DB361DB35EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A2C7B0 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01A2C83E
GetCurrentThread.KERNEL32 ref: 01A2C87B
GetCurrentProcess.KERNEL32 ref: 01A2C8B8
GetCurrentThreadId.KERNEL32 ref: 01A2C911

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 58616ec05ab4978d329b197977ed995775a77656c864300af188af8236c3f6d1
Instruction ID: 4f37ebe8253744380861c539ce96197e805d3df838ce1f67e1e6d0e3e5fa97ab
Opcode Fuzzy Hash: 58616ec05ab4978d329b197977ed995775a77656c864300af188af8236c3f6d1
Instruction Fuzzy Hash: 4D5165B090134A8FDB54DFA9D948BAEBBF1FF88324F208059D409AB3A0DB745944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01A2C7C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01A2C83E
GetCurrentThread.KERNEL32 ref: 01A2C87B
GetCurrentProcess.KERNEL32 ref: 01A2C8B8
GetCurrentThreadId.KERNEL32 ref: 01A2C911

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ef49ec2b715b2adcb4a85e8272eb4d7de597707ed737f8c26ec094950498b523
Instruction ID: e633f6bb811fdeddccc41f45a7ed0b078a11f917251ec9f9d4f9400e875eb8f5
Opcode Fuzzy Hash: ef49ec2b715b2adcb4a85e8272eb4d7de597707ed737f8c26ec094950498b523
Instruction Fuzzy Hash: DB5156B090034A8FEB14DFAAD548BAEBBF1FF88324F208459D419A73A4DB745944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 059DCBBC Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 059DCDFE

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c188ab16a493b7440ce1ef8ac671395be47ebf1e653344cd424d8d0125e95685
Instruction ID: a04955a9227a639117080099378501e4a8be82b71be1f5004f396ece633491eb
Opcode Fuzzy Hash: c188ab16a493b7440ce1ef8ac671395be47ebf1e653344cd424d8d0125e95685
Instruction Fuzzy Hash: EA913971D0061A9FEB10DFA8C845BEDFBB6BF48310F148569E809A7280DB759D85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059DCBC8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 059DCDFE

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 69e5e7afc71005dee0127c9804e3acc85189a59ac2be519f10c4ad62e9bca2fe
Instruction ID: 54ff800e00b96909e951b35140d5334f23f6274767f7c36149843bbd501bb8e0
Opcode Fuzzy Hash: 69e5e7afc71005dee0127c9804e3acc85189a59ac2be519f10c4ad62e9bca2fe
Instruction Fuzzy Hash: DA914A71D0061A9FEB10DF68C841BEEFBB6BF48310F148569E809A7280DB759D85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A528 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A2A77E

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9b37139bc945e01568299359c05791f5b12406eb20eccc50a63d282d39bb8dcb
Instruction ID: bf160f4ae7d84aa5c5c73b23aa16f436de72023241d008d06e2eb8a6bbd64087
Opcode Fuzzy Hash: 9b37139bc945e01568299359c05791f5b12406eb20eccc50a63d282d39bb8dcb
Instruction Fuzzy Hash: 37712370A00B158FEB25DF2ED54475ABBF1BF88604F008A2DD48ADBA50DB75E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 059D0F64 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 059D1082

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4dd72cdfbff53d3883dcfc19b71d2bddef4c75091d71278e7a28933fd0421963
Instruction ID: 9c04341710d2605f40fc60ee7ebdc10f02cb4cf6df15659affc75aff33189ed3
Opcode Fuzzy Hash: 4dd72cdfbff53d3883dcfc19b71d2bddef4c75091d71278e7a28933fd0421963
Instruction Fuzzy Hash: C251BEB1D10349DFDB14CF9AC884ADEFBB6BF88310F24812AE819AB250D7719945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 059D0F70 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 059D1082

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f468ab46c8ec5866a11b4f8d9f761bb625aad334d01c9c10da179c2287aae657
Instruction ID: 414a30398d9eb043f11222d8d89ea83ee324cd998ce5444a9482538873718792
Opcode Fuzzy Hash: f468ab46c8ec5866a11b4f8d9f761bb625aad334d01c9c10da179c2287aae657
Instruction Fuzzy Hash: 17419FB1D00349DFDB14DF9AC884ADEFBB5BF88310F64812AE819AB250D7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 059DCA28 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 059DCAB0

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fa0ca36fc38ef4d31672037cc933746744cf88c9c93869e96f62d6b3fe8dd831
Instruction ID: 83494c0bd815b489ff7dbe2e3ba2299484ec8d153650a1c408e0defedce52180
Opcode Fuzzy Hash: fa0ca36fc38ef4d31672037cc933746744cf88c9c93869e96f62d6b3fe8dd831
Instruction Fuzzy Hash: 3031BC75C013899FCB11DFA9C884BEEBFB5FF49310F14845AE5A5A7251C7388905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 059D36D0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 059D3791

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 895e6a563751e289424812d07ce23c6469ba6495eff8be649339977a739683a3
Instruction ID: 1015d4ae906447da6c133fab4678cff86a6ccc2891b4d4bfae7c25b3d174855c
Opcode Fuzzy Hash: 895e6a563751e289424812d07ce23c6469ba6495eff8be649339977a739683a3
Instruction Fuzzy Hash: AC411AB9900709CFCB54CF99C448AAAFBF5FB88314F24C859D519AB321D774A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059DC938 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 059DC9D0

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 65a95991c02eebc7e813ed85f84d95904966923c945710a3bb750e8668227412
Instruction ID: b3191651757758bf1600ad1d2de6feb30a4247f76dd684019bcd708cb0fed9d3
Opcode Fuzzy Hash: 65a95991c02eebc7e813ed85f84d95904966923c945710a3bb750e8668227412
Instruction Fuzzy Hash: 302124B59003499FDB10DFAAC885BDEBBF5FF88310F10842AE959A7240C7799954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 059DC940 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 059DC9D0

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 20d1ad80c14b9dd4d64819374286a9c4c60718354db0821f9b18a01a7addba82
Instruction ID: 7631acc6082bf71f5e87fafc0d34f74c65820866689a138f0b8f3747a29c2d9b
Opcode Fuzzy Hash: 20d1ad80c14b9dd4d64819374286a9c4c60718354db0821f9b18a01a7addba82
Instruction Fuzzy Hash: 8321257190034D9FDB10DFAAC881BDEBBF5FF88310F10842AE959A7240C7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 059DC7A0 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 059DC826

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: de95ea02cfa1da501a5841584bdb8045e72f5e04e3a43bc90383eab4c9debae3
Instruction ID: be5a2ecb5eb79750e43854a48b57c6b4e9f2fa4bfdc14284e059add39497859c
Opcode Fuzzy Hash: de95ea02cfa1da501a5841584bdb8045e72f5e04e3a43bc90383eab4c9debae3
Instruction Fuzzy Hash: 88213775D003098FDB14DFAAC485BEEBBF4AF88220F15842AD559A7241DB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 059DC7A8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 059DC826

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b39c279a538f617ec849149e14cd4845e827212e6542e787427eb458b9a5b9cd
Instruction ID: cdc3372158d2ac93e77462420641529b672d11420dfedf8e5117a1002b897e7a
Opcode Fuzzy Hash: b39c279a538f617ec849149e14cd4845e827212e6542e787427eb458b9a5b9cd
Instruction Fuzzy Hash: E0211571D003098FDB10DFAAC885BAEFBF4EF88320F54842AD559A7241CB789944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 059DCA30 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 059DCAB0

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 456a01ff3c93ff9355874aed8b79881d4810d20c4160b8ae453bf97df1b06d29
Instruction ID: 7534dec3a73583eb8ae22459e776d84f5c2835c4a440d39ed8dafec2aacc478e
Opcode Fuzzy Hash: 456a01ff3c93ff9355874aed8b79881d4810d20c4160b8ae453bf97df1b06d29
Instruction Fuzzy Hash: 4121F5718003499FDB10DFAAC881BEEFBF5FF88310F54842AE959A7240D7799944DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01A2CE09 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01A2CE97

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: be6216920fbe2330e61484e7aafdc8c05be8a18bc7a2ff0402323003d999d4ac
Instruction ID: 28c18495f327b91c1f08d9d6e8b1565f7e08836a71eeedb0d633d0088b98c6d9
Opcode Fuzzy Hash: be6216920fbe2330e61484e7aafdc8c05be8a18bc7a2ff0402323003d999d4ac
Instruction Fuzzy Hash: 6321E3B5D002099FDB10CFAAD984ADEBBF5FB48320F14841AE918A3350D379A954CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01A2CE10 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01A2CE97

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b07daf36bcb69a0f5c9833278bab5bd11ac62f6c204de81e6f6f143a4b40ed4c
Instruction ID: 3846eda89471166996009929bae58be8a08f2fd90963678e781c652a6f86e439
Opcode Fuzzy Hash: b07daf36bcb69a0f5c9833278bab5bd11ac62f6c204de81e6f6f143a4b40ed4c
Instruction Fuzzy Hash: 8B21E6B59002099FDB10CF9AD884ADEBBF4FB48320F14841AE914A3350C374A940CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01A298B0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A2A7F9,00000800,00000000,00000000), ref: 01A2AA0A

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2780bb2db538058937d0be1d058e63073c0fe40dc4c615d1f878aff5f900c6b
Instruction ID: d87d6694cf3f62314c91a74477d39e9b3f4ecc6a5007316b63e08ef71dbc0345
Opcode Fuzzy Hash: a2780bb2db538058937d0be1d058e63073c0fe40dc4c615d1f878aff5f900c6b
Instruction Fuzzy Hash: 9E1112B69003098FDB24CF9AC844BDEFBF4EB88310F14842EE519A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A998 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01A2A7F9,00000800,00000000,00000000), ref: 01A2AA0A

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9236f41b150c42a3294e5b809055bd48dfddf8defa2ee469f801325c63c2bd7
Instruction ID: f585be7c76370c95300c454e6d85afc86fc6bfef532ed7bb41e2a88865bc4aa3
Opcode Fuzzy Hash: b9236f41b150c42a3294e5b809055bd48dfddf8defa2ee469f801325c63c2bd7
Instruction Fuzzy Hash: 1611E2B69003098FDB14CFAAD985BDEFBF4EF88310F14841AD519A7610C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 059DC878 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 059DC8EE

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e114fc7417b778ac1686420512e7bae6d6c7b0ec4330666982cc41b98d8a2f54
Instruction ID: 0b46ed9cc54c19a559453489e6e2433c2a2c39bab0ad45cecc68a39183f680a6
Opcode Fuzzy Hash: e114fc7417b778ac1686420512e7bae6d6c7b0ec4330666982cc41b98d8a2f54
Instruction Fuzzy Hash: B81167768003498FDF10DFA9C844BEEBBF5AF88320F148819E915A7250C7359914CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 059DC880 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 059DC8EE

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 00c8adde5a9fefab4c92890fe62eb8245a9122966af62438d34081712c8411f0
Instruction ID: e21e7318b90a2a68a214fe84d9e2f19a7bf1b1406c031a4b8e33ab21f8cca7e0
Opcode Fuzzy Hash: 00c8adde5a9fefab4c92890fe62eb8245a9122966af62438d34081712c8411f0
Instruction Fuzzy Hash: 741126719003499FDB10DFAAC844BDEBBF5EF88320F148419E515A7250C7759950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 059DC6F0 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 059DC75A

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b1884201a5e42a43c4669d35fa44f94495b1611a19ddafbf710a87f9a118e805
Instruction ID: 9ccffdf23ae92958afdef64867b9d75327b485a990f1448c3530d3b52d5ec135
Opcode Fuzzy Hash: b1884201a5e42a43c4669d35fa44f94495b1611a19ddafbf710a87f9a118e805
Instruction Fuzzy Hash: 2B116AB5C003098FDB10DFAAC8457DEFBF5AF88614F24881DD529A7640C739A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 059DC6F8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 059DC75A

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b76224f4349e303899ea02dab60ee8f5a6c0f23df7e99808adad8a796f4509b8
Instruction ID: cb84629643bce54dea2ac51732136a6f0c24eaf76b8ed85a3909633ab2b1d07d
Opcode Fuzzy Hash: b76224f4349e303899ea02dab60ee8f5a6c0f23df7e99808adad8a796f4509b8
Instruction Fuzzy Hash: D41136759003498FDB20DFAAC84579EFBF9EF88620F248419D519A7240CB79A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01A2A718 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01A2A77E

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 74541f1f10ad5476ca8bf4ac96296879be84284ac9d0112e2796c0b82cf0e807
Instruction ID: b24dabd138b3c99e1778a03289630f4f1cef6ba81a5e03cb3b71719f1d1410c4
Opcode Fuzzy Hash: 74541f1f10ad5476ca8bf4ac96296879be84284ac9d0112e2796c0b82cf0e807
Instruction Fuzzy Hash: EB1110B5C0034A8FDB10CF9AC844BDEFBF5EB88620F10842AD429A7600C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0156D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395235247.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe244e91e76bc09abc7c865ec5ae42585845c5df42d158cb667a5b0f3e26189
Instruction ID: 7170932855f8ecdeb2af1491ad275e3934ac45bd9ddfc2fd056b55833ff14c74
Opcode Fuzzy Hash: bbe244e91e76bc09abc7c865ec5ae42585845c5df42d158cb667a5b0f3e26189
Instruction Fuzzy Hash: E0210271604300DFDB11DF44D8C0B2ABFB9FB94324F208969D9490F656C376D806CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 0184D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395601753.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873e6d6fdce0c1c5f79d7fe44eca39d70cf4c7c7a4547f7a41bcc114e33c282f
Instruction ID: 48cc27218131b1fbc873b33fe0d1c7a26f990ea23bd8d2e64d0c27a61c919ae2
Opcode Fuzzy Hash: 873e6d6fdce0c1c5f79d7fe44eca39d70cf4c7c7a4547f7a41bcc114e33c282f
Instruction Fuzzy Hash: 15212275604308DFDB15DF94D8C4B16BB61FB94318F20C66DD80A8B386CB3AD507CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0156D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395235247.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 2065bffe3f01105329462a39fd8c9a98e7591082b01c1347a22487f777687911
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 3211DF76604240CFCB12CF48D5C0B1ABF72FB94324F2486A9D9490B657C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0184D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395601753.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: ff000c3e47e005b27c2f1437bda002f8abe7032edcad93c2b757d8367f135e44
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: D911BE75504284CFCB16CF54D5C4B15BB62FB44314F24C6ADD8498B656C33AD50ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01A2F5B8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3800d15e07396b712342bd0a47ac6ef67a0634c7725dfd174517ded8c786e43
Instruction ID: bf2e7c09eaf338812c394df278facc0358f3021c3d9702b5cb5733ad5093696f
Opcode Fuzzy Hash: a3800d15e07396b712342bd0a47ac6ef67a0634c7725dfd174517ded8c786e43
Instruction Fuzzy Hash: B31281BBC197468BE730CF65E94C1993BB1BB81328B904309D2612F2E9DBB8155BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 01A2CD3C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eade0eef8d1caa6221c2f65419ec14337a44a26409ffa743016a27af0c4e114c
Instruction ID: c2c512d683f5cd217e9dcad492ae75eb43b311af133780c106ce9c6908623f44
Opcode Fuzzy Hash: eade0eef8d1caa6221c2f65419ec14337a44a26409ffa743016a27af0c4e114c
Instruction Fuzzy Hash: B9A18136F002258FCF15DFB8C94099EBBB2FF85300B15856AE905AB265DB31E946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01A2F5B6 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1395972591.0000000001A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a20000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a222ae145d9b360b596fd673165def0eb2a1a4fea95629e5913db2a34882466
Instruction ID: 7cd8db8813340c6cedbf1dd289f80b9f0384fcb86442b484a7745bbb78d25975
Opcode Fuzzy Hash: 2a222ae145d9b360b596fd673165def0eb2a1a4fea95629e5913db2a34882466
Instruction Fuzzy Hash: 81C1E7BAC19746CFE720CF65E84C1997BB1BB85324F514309D2612B2E9DBB8245BCF44

Uniqueness

Uniqueness Score: -1.00%

Function 059DCF3F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1400258017.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59d0000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48968e9deac68b22034f238b13f90613e8b1f815271a8d636ea69cfe2849959
Instruction ID: 8eafd0edbfc0ae7ed94e60dc1b6a8d7560bd12e03aaade42168e3df6bc459b46
Opcode Fuzzy Hash: c48968e9deac68b22034f238b13f90613e8b1f815271a8d636ea69cfe2849959
Instruction Fuzzy Hash: 223197B1D016288BEB28CF56C9157DAFAF6BFC5304F04C1EAC54C6A254DB750A89CF51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3956, Parent PID: 4276COMMON

Executed Functions

Function 06854C20 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

|l^, xrefs: 06854CDA

Memory Dump Source

Source File: 00000002.00000002.1418081007.0000000006850000.00000040.00000800.00020000.00000000.sdmp, Offset: 06850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6850000_powershell.jbxd

Similarity

API ID:
String ID: |l^
API String ID: 0-3878752382
Opcode ID: 325a2594db4228d52cc42e7f1d90373d96aa5ad5970b7360efe210de1a130bf6
Instruction ID: d6fdefb70d92974f4f891ee6edad686d46a850fc5ef09216ccbe5799bfd939f2
Opcode Fuzzy Hash: 325a2594db4228d52cc42e7f1d90373d96aa5ad5970b7360efe210de1a130bf6
Instruction Fuzzy Hash: 6141827590E3D59FDB03DB28D8A459ABFB0AF8721070A40C7D495DF2A3C7249C49CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 07371C10 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1420920034.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5645722adceaa7f63f00a13d718c2160cdabbc3ec9223bdfdc45300a92c17d00
Instruction ID: d6c38c077010588d42940bc43b106782ed6e84dde159982843347a8b5207f25b
Opcode Fuzzy Hash: 5645722adceaa7f63f00a13d718c2160cdabbc3ec9223bdfdc45300a92c17d00
Instruction Fuzzy Hash: EB127CB27043198FE7359B78881177BBFB6AFC6211F14C06AD949DB642DB35C841C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 068529F0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1418081007.0000000006850000.00000040.00000800.00020000.00000000.sdmp, Offset: 06850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7bb3e819aebd9803ec9dc8b9b11a1ff49f8061a9800e3ae44261fb22a27183f
Instruction ID: ec36bdab4d2c238adb1399a60ece4c535f4ceae3504cc5b7161c6726c40f6fcd
Opcode Fuzzy Hash: f7bb3e819aebd9803ec9dc8b9b11a1ff49f8061a9800e3ae44261fb22a27183f
Instruction Fuzzy Hash: 8C917A74A002058FCB16CF58C4A4AAEFBB1FF88310B258699D915EB365CB35FD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07371BF0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1420920034.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7b8d5bee3583e29175039791ae98acb9a6e709cb9d95407f1e1eb24301aae0
Instruction ID: c497cce0a1361d7c801b51a24f5a24e5550b9c4b72e8472922cb3ed2925cd882
Opcode Fuzzy Hash: 5d7b8d5bee3583e29175039791ae98acb9a6e709cb9d95407f1e1eb24301aae0
Instruction Fuzzy Hash: 6D412AF3A0420ADFEB358F6585416797BB29FC2210B14C1A6D848AF652D739DC44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06852B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1418081007.0000000006850000.00000040.00000800.00020000.00000000.sdmp, Offset: 06850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f85154927eca4b26dc841e579a220e9ff0017d541148a113a6de26a456a59f
Instruction ID: 823792db689e4d908752838b908511ef8c798a88f1fc9f8eec4048da06430d6f
Opcode Fuzzy Hash: 19f85154927eca4b26dc841e579a220e9ff0017d541148a113a6de26a456a59f
Instruction Fuzzy Hash: A3411874A006059FCB05CF58C4E8AAEF7B1FF88310B168299D915AB365C736FD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06854C10 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1418081007.0000000006850000.00000040.00000800.00020000.00000000.sdmp, Offset: 06850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e099b9915bbe70a2a33560686f6b23ce0eb116e314cc470daf016c33d0bf2e1
Instruction ID: 75c4a2d812678db2e5345654f7160701bcd8631667d7e2b0a6d4181a89c90b83
Opcode Fuzzy Hash: 8e099b9915bbe70a2a33560686f6b23ce0eb116e314cc470daf016c33d0bf2e1
Instruction Fuzzy Hash: B1212E74A042499FDB41CFA8D4909AEFBF1FF8A310B158599D845EB362C331EC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06854BF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1418081007.0000000006850000.00000040.00000800.00020000.00000000.sdmp, Offset: 06850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ffada826102a92c266e085e90bd7738263e7a7f4f05399ae2b74c276a4a3ee
Instruction ID: c730f04e677335a13186de0c71bf74ce638a6b12989a71b1d48204642ec0e3f1
Opcode Fuzzy Hash: 11ffada826102a92c266e085e90bd7738263e7a7f4f05399ae2b74c276a4a3ee
Instruction Fuzzy Hash: 43114C34A056498FDB01CFA8C4909ADFBF1FF8A310B19859AD859EB362C735EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0435D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1411154436.000000000435D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0435D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_435d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd338343cc810262924bd452c8cc8d410a6edbfa51ac7a512749d9dd6de6bb7f
Instruction ID: 05b19d39c871a35dd94435c99b0b9695e6be35fff169105dededb11d2127e784
Opcode Fuzzy Hash: dd338343cc810262924bd452c8cc8d410a6edbfa51ac7a512749d9dd6de6bb7f
Instruction Fuzzy Hash: 1D01F2715083049BE7204E21ECC0F67BF98EF81725F18C01AED084B692D679A842CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0435D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1411154436.000000000435D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0435D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_435d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae5ca567d4fd7c1092315d6913ef6f194963d5dfbe1ef41c64111c8f3ad96b9
Instruction ID: dc75f1a5b04499b9911c312b65847c79429ec12bbde6d3f876855ae17881f464
Opcode Fuzzy Hash: 0ae5ca567d4fd7c1092315d6913ef6f194963d5dfbe1ef41c64111c8f3ad96b9
Instruction Fuzzy Hash: 2F015E7240E3C49FD7128B219894B52BFA4DF42225F19C0DBDD888F2A3C2699848C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07371270 Relevance: 5.5, Strings: 4, Instructions: 492COMMON

Download Yara Rule

Strings

l, xrefs: 07371365
l, xrefs: 0737180E
l, xrefs: 07371357
l, xrefs: 07371800

Memory Dump Source

Source File: 00000002.00000002.1420920034.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7370000_powershell.jbxd

Similarity

API ID:
String ID: l$l$l$l
API String ID: 0-2658161240
Opcode ID: 2aa76c73819f816d57efaad5f2b9ea28435bf98171c23856f9c21d877ef9e0fc
Instruction ID: acabf733be7304610916a6717334266c52a49209e4a3e16ba9ac4def2cc66103
Opcode Fuzzy Hash: 2aa76c73819f816d57efaad5f2b9ea28435bf98171c23856f9c21d877ef9e0fc
Instruction Fuzzy Hash: B8F13AB37042198FEB349B68D4017AABBF6AFC5221F14C07AD84ACB651DB35CD45C7A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hesaphareketi_1.scr.exePID: 1988, Parent PID: 4276COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	130
Total number of Limit Nodes:	10

Executed Functions

Function 070919E8 Relevance: 2.8, Instructions: 2847COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3909401ef2a5fabd982bcc12d719c47545ccefbcfc6e6d6528b74e1ddaaf6a0
Instruction ID: b5a2121a266d8b12c5691fb705e27e58020f7e06d5a79fcd8b2cbad9f9890416
Opcode Fuzzy Hash: d3909401ef2a5fabd982bcc12d719c47545ccefbcfc6e6d6528b74e1ddaaf6a0
Instruction Fuzzy Hash: B563F671D10B5A8ADB51EF68C880699F7B1FF99300F11C79AE45877221EB70AAC5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 07094E20 Relevance: 2.2, Instructions: 2222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0accbbd57930ae05d057edcc61e18c8735abb5c3a6819b001d51dd3695e3eaa
Instruction ID: a40004165c4648271887f957d39acd3725f38b17118f37065ee136ce346165c5
Opcode Fuzzy Hash: d0accbbd57930ae05d057edcc61e18c8735abb5c3a6819b001d51dd3695e3eaa
Instruction Fuzzy Hash: 12232E71D1071A8EDB11EF68C8806ADF7B1FF89300F55D79AE448A7251EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07084078 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2672447077.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_hesaphareketi_1.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 51083340d1d5a4cf257f1cc1d1344b6ae919abffb5fddff3ea3564021d5c2ab7
Instruction ID: d9fae85fddd2022ac9b8099631087706db074286030c52400ff1c0846454b292
Opcode Fuzzy Hash: 51083340d1d5a4cf257f1cc1d1344b6ae919abffb5fddff3ea3564021d5c2ab7
Instruction Fuzzy Hash: 05F160B0A0035ACFDB94EFA5C844B9DBBF1FF88304F158269E855AF265DB709945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0709A680 Relevance: 1.8, Strings: 1, Instructions: 590
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 0709A9F6

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 0b5070c61937d5756f1da114e7412f1c0887745375365559ee05c8510d4ab219
Instruction ID: 512cf2ba76c2858331cee0c3dda4b576e4c67bb24ed4d6ac617c4bce8458fa67
Opcode Fuzzy Hash: 0b5070c61937d5756f1da114e7412f1c0887745375365559ee05c8510d4ab219
Instruction Fuzzy Hash: 7822A0B1F002168FDF64DA64C8806AEBBF2FF85310F10867AD856AB350DA35ED41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 030ACC98 Relevance: 1.7, APIs: 1, Instructions: 245
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 030ACC5D

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6e1d3fff122f430a20151c63882a78eec4ab7f0afd85b8805ea52b0518580f2a
Instruction ID: daddd66308426b558c9395a3b4ef656d7d2dd46d566018ade57f39a7e3f09b0e
Opcode Fuzzy Hash: 6e1d3fff122f430a20151c63882a78eec4ab7f0afd85b8805ea52b0518580f2a
Instruction Fuzzy Hash: 3ED154B1401749AFD728EF64EC8C189BB76BBAA324F504709D1516B2D8E77414FACF60

Uniqueness

Uniqueness Score: -1.00%

Function 07097440 Relevance: 1.5, Instructions: 1497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985b779893e4ddb41dabe1d03fdeacbb418f763cf9ee51f924ba2e58d9bfc915
Instruction ID: c31641f3022094e530a3e9ea1d857dc737971f891ddf5fab0bf5ab0691f30b43
Opcode Fuzzy Hash: 985b779893e4ddb41dabe1d03fdeacbb418f763cf9ee51f924ba2e58d9bfc915
Instruction Fuzzy Hash: 9FD27D71A10209CFDB64DB68C594A9DB7F2FF85310F54C6AAD409AB361EB31ED81DB80

Uniqueness

Uniqueness Score: -1.00%

Function 07091A99 Relevance: 1.3, Instructions: 1321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf38703505b9941f6b6bb0f5fe45c27add99a3e417564a1d7d301ea5f54cedc
Instruction ID: 8d35b760a231a60ea6e75a89f56e5fb4dde444b00266c1a40a4a496088f8b0fa
Opcode Fuzzy Hash: caf38703505b9941f6b6bb0f5fe45c27add99a3e417564a1d7d301ea5f54cedc
Instruction Fuzzy Hash: A9E2E671D10B1A8ADB50EF68C8406A9F7B1FF99300F11D79AE44877221EB70AAD5CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0709B6C8 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a27e0ae9572bcd3bee0c92fc2b2b17c870893b9b804a3b905926827373137
Instruction ID: ffbb8e9ba1662c607c5feb39bf6f5c21cd28ac15b9473cad6bf0bed1f1497657
Opcode Fuzzy Hash: de8a27e0ae9572bcd3bee0c92fc2b2b17c870893b9b804a3b905926827373137
Instruction Fuzzy Hash: 7D627DB4B0020A8FDF54DB68E5946ADB7F2EF89324F148669D806DB390DB35EC42DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0709CE58 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72b531d13ef60c5576ef4d62a6c56630bf75a65d598dee584aeea6cd6c23d3e
Instruction ID: 47293a0025e740616cd32adfeaa43f445cb617911333ce0d464df8d6a3e5e83b
Opcode Fuzzy Hash: f72b531d13ef60c5576ef4d62a6c56630bf75a65d598dee584aeea6cd6c23d3e
Instruction Fuzzy Hash: FF027A71B00216DFDF54DB79D9946AEB7E2FF84210F148669D806AB390DB35EC82DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0709ADD0 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32da7556c605e42f1149d0dd8048bcf0621e49c84a1b67e707cab27986886aa
Instruction ID: 69b845df4fd2d455768b819b8fa27a2db83bc8e21d3d0fb9b3f2533aa39f6a32
Opcode Fuzzy Hash: e32da7556c605e42f1149d0dd8048bcf0621e49c84a1b67e707cab27986886aa
Instruction Fuzzy Hash: 1FD1F5B1B001198FCFA4DB68D494AAEB7F6FB88320F24857AE41ADB351CA31DC41D791

Uniqueness

Uniqueness Score: -1.00%

Function 030AAC48 Relevance: 1.8, APIs: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 030AADD7

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: ca7ae45ad0c4a5f4c66557d34e5011a0c60d8185d0d5afa57b54532c8b4d092d
Instruction ID: 2db2d9e0d6a57d0c53b32c21db42d315562350ebe4dbac42a89240e62c3b1fa9
Opcode Fuzzy Hash: ca7ae45ad0c4a5f4c66557d34e5011a0c60d8185d0d5afa57b54532c8b4d092d
Instruction Fuzzy Hash: 09C18130B103199BDB59DFA9941476EBBE6FFC8340F148429E806EB394DF749842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030AAC42 Relevance: 1.7, APIs: 1, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 030AADD7

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 6f4e090776d6e59b01e0e604d0274cebdc09c9dbe1f725e358aed916bd0ff0a2
Instruction ID: 65d269501432a17b9a0076835323eb48a632973f31649e677f6584495242ca98
Opcode Fuzzy Hash: 6f4e090776d6e59b01e0e604d0274cebdc09c9dbe1f725e358aed916bd0ff0a2
Instruction Fuzzy Hash: E4617F74E01719DFDB58DFA9E4497ADBBF2FF88301F188429E806AB294DB749841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07081F10 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 07081FD1

Memory Dump Source

Source File: 00000004.00000002.2672447077.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_hesaphareketi_1.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 40f0c7a1ae06f51b7d397c5f9d22308f73c0d6a3dab27ccdc065fd497ce7a8d7
Instruction ID: b7bd00dc2a3c8dd2525c5edb541b94d1f46ccf412265b90356a799df40414443
Opcode Fuzzy Hash: 40f0c7a1ae06f51b7d397c5f9d22308f73c0d6a3dab27ccdc065fd497ce7a8d7
Instruction Fuzzy Hash: AE4147B4900309DFCB54DF99C888AAABBF5FF88314F24855DE519AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030ADF7C Relevance: 1.6, APIs: 1, Instructions: 79
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,030ADEA0,041441C4,03195178), ref: 030ADF31

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: edc47a1ee78854e18b7730949600aedcf55ad88cbb7a715dc0a06850c121d8fa
Instruction ID: b8dbd38c72a82461f37004e0191df83a56b61f420f2b236696018dbe10708387
Opcode Fuzzy Hash: edc47a1ee78854e18b7730949600aedcf55ad88cbb7a715dc0a06850c121d8fa
Instruction Fuzzy Hash: F7318B75A01609CFDB10CF99D854BEEBBF5AF8C320F28815AE414E73A0C7789940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 030AC1DB Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 030AC267

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 020930125727fba42ab2089d8408ef9ee6413399a7d020fd1a4f405ba3ecbb34
Instruction ID: 63d1e428737a8c06831b4c27bd05b3369c9f634519d43174c726ac2c558bb987
Opcode Fuzzy Hash: 020930125727fba42ab2089d8408ef9ee6413399a7d020fd1a4f405ba3ecbb34
Instruction Fuzzy Hash: A321E4B5901249AFDB10CFAAD884ADEFBF5FB48320F14841AE914A7350D378A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030AC1E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 030AC267

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a52b8ea759f194c9c512a34089c772138bb57b74570810e97bea5dee38b4a2d0
Instruction ID: 3abd1364c04dae66b24439c0148eb36c192f270e804fd2abd9f212e4f915be51
Opcode Fuzzy Hash: a52b8ea759f194c9c512a34089c772138bb57b74570810e97bea5dee38b4a2d0
Instruction Fuzzy Hash: 5C21F5B59013099FDB10CFAAD884ADEFBF9FB48710F14841AE914A7350D378A940CF65

Uniqueness

Uniqueness Score: -1.00%

Function 030ADBD8 Relevance: 1.6, APIs: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 030AEA50

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 9ad5d45b68333d4f1843042a2bab8ee66ca906872e8c9309fa3b3340bf57e813
Instruction ID: 449aeee0fb4f2bae02cc829b7f65ff367b5a6a77ce9e4016b897478a4f715540
Opcode Fuzzy Hash: 9ad5d45b68333d4f1843042a2bab8ee66ca906872e8c9309fa3b3340bf57e813
Instruction Fuzzy Hash: D22177B1C00B5A9FCB10CF9AD4407DEFBF4BF48620F14852AD818A7240D738A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030AD9BC Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,030ADEA0,041441C4,03195178), ref: 030ADF31

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 35abf93e48347fd0473d57d9b87281ca45ea86bf3f5aa2b1c763c7054c3b3738
Instruction ID: bec2ba73ce0071ec63bf4fd3449656d93a72481d49b7ec7e9ba7f2bd6babb2e5
Opcode Fuzzy Hash: 35abf93e48347fd0473d57d9b87281ca45ea86bf3f5aa2b1c763c7054c3b3738
Instruction Fuzzy Hash: 752127719006098FDB14DF9AD844BEFFBF5EB88320F14842AE814A7650D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030ADEB8 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,030ADEA0,041441C4,03195178), ref: 030ADF31

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 4a5cb601f5af0bc160925a23c6c8c6fb1d10ff2bafda2ad16499566f64a4ff2d
Instruction ID: 7b9cc91dcf702608657b12b6af6fe8dc63065041c68db5e916f34e4d4a6c12a7
Opcode Fuzzy Hash: 4a5cb601f5af0bc160925a23c6c8c6fb1d10ff2bafda2ad16499566f64a4ff2d
Instruction Fuzzy Hash: 34212771D006098FDB14DF9AD844BEEFBF5EB88320F14842AE814A7650D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030AA81C Relevance: 1.6, APIs: 1, Instructions: 60
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,030AAE8D,?,?,?), ref: 030AE2CD

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: c5fc207a8f623defcd2f6829f2ab83a8eb3e3d669007a0faeb8b958ff54cd1b9
Instruction ID: 62f8eeaa9e5010113ea5e0aa5f62e3207f3748408982e7566810a0e5ca8402c0
Opcode Fuzzy Hash: c5fc207a8f623defcd2f6829f2ab83a8eb3e3d669007a0faeb8b958ff54cd1b9
Instruction Fuzzy Hash: 632104B58017099FDB14CF9AD884ADEFBF5FB88314F14892EE919A7200C375A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 030ADB5C Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 030AEA50

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ca880a15712dd2c7a42dff7a6ef546c1ec076af2319a300d1ecdd607ab86ec7e
Instruction ID: 008ffa8a2240b1a11a8a8fecf5a93d633f1af08d65fd20f602ee4c5b64172769
Opcode Fuzzy Hash: ca880a15712dd2c7a42dff7a6ef546c1ec076af2319a300d1ecdd607ab86ec7e
Instruction Fuzzy Hash: FC2156B1C00A1A9BCB10CF9AD4457AEFBF4FF48720F14852AD818A7240D738A900CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030AE249 Relevance: 1.6, APIs: 1, Instructions: 58
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32(?,00000000,00000000,?,?,?,?,?,?,?,030AAE8D,?,?,?), ref: 030AE2CD

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 2b6ee9cda631a47bfbbcfa3c6b0cd3d0c2cc4ad221ffa2919742c9f54dd48521
Instruction ID: 55b983b95c24d0d02d111d105bd3c6e119f374c5a557e46bd9ed209216878fd7
Opcode Fuzzy Hash: 2b6ee9cda631a47bfbbcfa3c6b0cd3d0c2cc4ad221ffa2919742c9f54dd48521
Instruction Fuzzy Hash: B92132B6C017498FDB10CF9AD884ADEFBF1BB48314F14892EE818A7200C374A544CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 030AE9D9 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 030AEA50

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2f0fd92ff529da83814ac14b526dea6b27e4607f6fc882e1b82f54ac12baf0f1
Instruction ID: 865e8391cef98d71b859be7ad1496b2717fa0d88bfe924bb7855be391605d999
Opcode Fuzzy Hash: 2f0fd92ff529da83814ac14b526dea6b27e4607f6fc882e1b82f54ac12baf0f1
Instruction Fuzzy Hash: 3F2147B5C00A5A8FCB14CFAAD5457DEFBF0BF48320F15852AD858A7280D738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07084DDA Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0708439F), ref: 07084E3D

Memory Dump Source

Source File: 00000004.00000002.2672447077.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_hesaphareketi_1.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 88e978dba3c53162cf3a7556ee96e6e2318478bae883eefb27816b3d6c5ad040
Instruction ID: f10e2b9aadbb70a33384ae8ba382136ea3c1c2ee09f80df574bdc845543bfe7b
Opcode Fuzzy Hash: 88e978dba3c53162cf3a7556ee96e6e2318478bae883eefb27816b3d6c5ad040
Instruction Fuzzy Hash: B41103B5C007499FCB10EF9AE845BDEFBF4EB48324F10851AE418A3600D779A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0708353C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,0708439F), ref: 07084E3D

Memory Dump Source

Source File: 00000004.00000002.2672447077.0000000007080000.00000040.00000800.00020000.00000000.sdmp, Offset: 07080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7080000_hesaphareketi_1.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 83c90e2988fe1ab1974cffc4b39b1afc4d849211cac874172bf8ff11d90867fd
Instruction ID: 3aa8056364f4caeec14b4f8fa725571e8be50737f5c572760fc735cf31f45ba0
Opcode Fuzzy Hash: 83c90e2988fe1ab1974cffc4b39b1afc4d849211cac874172bf8ff11d90867fd
Instruction Fuzzy Hash: 9111F2B5C0475A9FCB10DF9AD444B9EFBF4EB48314F10851AE568A7210D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030AC0F0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 030ACC5D

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d6ebe28f3a271bc6c568129813de5480bf1e673eedc780fe936c29ff0ec52cee
Instruction ID: 0b7b01eda79512cc4f69703c6b505fcf93be35facf607fc1a0155e56488a5d75
Opcode Fuzzy Hash: d6ebe28f3a271bc6c568129813de5480bf1e673eedc780fe936c29ff0ec52cee
Instruction Fuzzy Hash: 881112B58007498FDB20DFAAD548BDEFBF8EB48724F24841AD518A7200D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030ACC00 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 030ACC5D

Memory Dump Source

Source File: 00000004.00000002.2640038621.00000000030A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30a0000_hesaphareketi_1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 79b09572a81aa97db83e87d9bfe9a94bc835be7a0dd363370a486c1349a60b0a
Instruction ID: cd064aa783f4739f00529ab26b6744d1f40dd8489783defc6733db017dff89e0
Opcode Fuzzy Hash: 79b09572a81aa97db83e87d9bfe9a94bc835be7a0dd363370a486c1349a60b0a
Instruction Fuzzy Hash: 881175B5C007488FDB20DFAAD5457CEFBF4EB48324F24881AD518A3240C378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07091220 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24867a9f4609f7599314c91fd95a2e321b129de687c7e474e9e08f0e2b2f37b
Instruction ID: deb77fe74f1d4a177d47cbd0f31429752acd952055b0f09884257080d35b9aca
Opcode Fuzzy Hash: c24867a9f4609f7599314c91fd95a2e321b129de687c7e474e9e08f0e2b2f37b
Instruction Fuzzy Hash: F1F16EB4B0020A9FDF54DB68D9846ADBBF2FB89350F148669D806DB390DB35DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07099337 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8466dedabdc20c0efa2a5834f3b29dbc86b41ea600a5f935ccef602084b5bae
Instruction ID: 6cb128795c7fd5018f859382058803a3db22e9becb290081fb463b0b1437a682
Opcode Fuzzy Hash: b8466dedabdc20c0efa2a5834f3b29dbc86b41ea600a5f935ccef602084b5bae
Instruction Fuzzy Hash: 60919F70B1124A8FDF45DFA4D49069EBBF6AFC5300F108679D40ADB291DB34EC868B91

Uniqueness

Uniqueness Score: -1.00%

Function 0709120C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82220f5f12b2c54d9b5bbf26232a020c25dd0fc2c4e9a46bd9e63fb4aa3fc4f4
Instruction ID: 582a32e7286ad1dc61057f99c403af8264c95c342fab14e437581f4826588cbb
Opcode Fuzzy Hash: 82220f5f12b2c54d9b5bbf26232a020c25dd0fc2c4e9a46bd9e63fb4aa3fc4f4
Instruction Fuzzy Hash: 2F912A74B0020ADFCF54DB68D584AADBBF2FB88351F148669E906D7360DB31AC42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0709E228 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0e7f814a80b5f5157d5c6803e98566286b435c22e95096c62b2698be102169
Instruction ID: 85b600939b381c917881e0611bfe26b226e91370ecd5bd67a4a3d1df89262110
Opcode Fuzzy Hash: 3f0e7f814a80b5f5157d5c6803e98566286b435c22e95096c62b2698be102169
Instruction Fuzzy Hash: 9B914F71B1021A8FDF94DB65D8507AEB7F6FFC5200F10856AD80AEB344EB319D819B91

Uniqueness

Uniqueness Score: -1.00%

Function 0709B2C8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdab47da58dbbec51b97de4aa904a6279eb03c00439b6b40296494f37b68401a
Instruction ID: dc73797002d4513bb59e514252ddb6b607a6546d0a7eb380ea3976b21bab5adf
Opcode Fuzzy Hash: cdab47da58dbbec51b97de4aa904a6279eb03c00439b6b40296494f37b68401a
Instruction Fuzzy Hash: 3761D7F1F001124BDF50A67ED84055EBADBEFC4620B154536D80ADB3A0DE65EC4287C5

Uniqueness

Uniqueness Score: -1.00%

Function 07099390 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a4a957a8ea320941c2061c96d5ca828e32e8ebff068e75152d78c6dcca9a8c
Instruction ID: 978b397afdd417a6be71b0ac1a1095d5269bf3a87c0d436400e39c46008f7f8a
Opcode Fuzzy Hash: e0a4a957a8ea320941c2061c96d5ca828e32e8ebff068e75152d78c6dcca9a8c
Instruction Fuzzy Hash: A9812B70B1020A8FDF54DBA9D55066EBBF6AFC9300F108539D80ADB394DA75ED828B91

Uniqueness

Uniqueness Score: -1.00%

Function 07091748 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4090e9d18a32eb11768a0a2b73a39753b7925e27191930d6a40c71c35c8c6b
Instruction ID: 2400b683881297f89550627349433974b300f3f8a43d6f562c2b710377ac7003
Opcode Fuzzy Hash: ae4090e9d18a32eb11768a0a2b73a39753b7925e27191930d6a40c71c35c8c6b
Instruction Fuzzy Hash: DD818EB5B0020A8FDB54CF69D884B9EBBF6FF88310F14C269E9089B395D7719845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 070996A4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86428e29be7efcd0277f6678ddcc0c3845e10b47a230ec26f0bbd2991ff0f6e
Instruction ID: 811bfc326f3153848e86817b384b54da2323af6f2924d8042407e81c8e9f1d39
Opcode Fuzzy Hash: e86428e29be7efcd0277f6678ddcc0c3845e10b47a230ec26f0bbd2991ff0f6e
Instruction Fuzzy Hash: 36915E70E1061A8BDF60DF68C840B9DB7B1FF89310F2086A9D449BB395DB71A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 070996B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e1097addf221201500d44560b1a993913bd7d15242309c96864c27237d499e
Instruction ID: ea03f721649d716131ba08b29ed00c8def960be3a111653b10a0b3fae8641b2a
Opcode Fuzzy Hash: 81e1097addf221201500d44560b1a993913bd7d15242309c96864c27237d499e
Instruction Fuzzy Hash: 82914E70E1061A8BDF60DF68C880B9DB7B1FF89310F2086A9D549BB354DB71A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07099C50 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1219b6d8bb25299dbedc2157c7a9a949b52f672558c15b399c5d0b8be3ec6986
Instruction ID: d9f4a5d603b9deba9c537527ce68e6617e87f7ff2a01a527e887c34602d83aa4
Opcode Fuzzy Hash: 1219b6d8bb25299dbedc2157c7a9a949b52f672558c15b399c5d0b8be3ec6986
Instruction Fuzzy Hash: 7861A1B0B002099FDF549BA5C8147AEBBF6FBC8740F20852AE50AAB390DB755C45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0709E217 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825dc5c4810db531af5e5f35d587de90c29b8a3971000e212f0e5b52d38340df
Instruction ID: 9e7ec775d5098ab20720e6d8c96142e97d389bd89eb2df0c0177f22f5110cca1
Opcode Fuzzy Hash: 825dc5c4810db531af5e5f35d587de90c29b8a3971000e212f0e5b52d38340df
Instruction Fuzzy Hash: 79517071B111068FDF94DB65D8507AEB7F6EFC8200F10896AD80ADB384DB35DD829B90

Uniqueness

Uniqueness Score: -1.00%

Function 07099C40 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13a2afe5bdcf87cac0296b8e8b16ece2348ca6edf9f5cee8c5dab9967c74d8c
Instruction ID: 625347cc2e0d8447ac8c7ed61a602df6a9c7671d6fc310ca955940171432982a
Opcode Fuzzy Hash: c13a2afe5bdcf87cac0296b8e8b16ece2348ca6edf9f5cee8c5dab9967c74d8c
Instruction Fuzzy Hash: 0A519071F002099FDB949BA5C8147AEBBF6FFC8740F20852AE506AF394DA715C419B91

Uniqueness

Uniqueness Score: -1.00%

Function 0709A508 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322c77416c99a81f8d795caa3cddb11271742256c534cf8c1f1043fd929612f5
Instruction ID: f1094ffcfed8c42176ad02342688e3731df5fb6757b764668aba175c2dcb4793
Opcode Fuzzy Hash: 322c77416c99a81f8d795caa3cddb11271742256c534cf8c1f1043fd929612f5
Instruction Fuzzy Hash: A2412DB1B0060A9FDF60CE99D880AAFF7F6FB84210F108A3AE156D7650D734E945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 070972A5 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd371d2dd149e4663a66a2671c007a9d44d0a1b6691dc53bf5aadf60046df3aa
Instruction ID: 7ebb5b865122ec1b809681d11e7db23bd9955d5046e8edb1a2557d9f25372adc
Opcode Fuzzy Hash: fd371d2dd149e4663a66a2671c007a9d44d0a1b6691dc53bf5aadf60046df3aa
Instruction Fuzzy Hash: 32311E71B102068FDF559B34D8546AE7BE2FB89620F209679E806DF381EF34CC469B91

Uniqueness

Uniqueness Score: -1.00%

Function 070972B8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e4438f8f66043a95c91b67a9354c05c96bea0f4a73604362ba7a0b5a23c52b
Instruction ID: 942b5e9126d0c09abd0f8f164c194a1099655cac1102306500b7d2925badcc29
Opcode Fuzzy Hash: 14e4438f8f66043a95c91b67a9354c05c96bea0f4a73604362ba7a0b5a23c52b
Instruction Fuzzy Hash: 26311CB1B1020A8FDF599B34C4146AE7AE2FBC9610F209678D806DF380EF30CC429B90

Uniqueness

Uniqueness Score: -1.00%

Function 07097168 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47ecbfb563bf1bdb6a0bc27dbba9038d37366ee3adc71a0af58f50bb4f27ea3
Instruction ID: 611068e06de72e35bac4810e8c02051d0de578b09cdefc4391acede9ebb3fc2a
Opcode Fuzzy Hash: d47ecbfb563bf1bdb6a0bc27dbba9038d37366ee3adc71a0af58f50bb4f27ea3
Instruction Fuzzy Hash: 4E317275A2020A9FDB55CFA4D85469EB7F2FF89300F108629E806EB350DB34AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07097178 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f94197b1bc75d31b451af3ba042550fd673155e0dfa5d3c67621a4e2041656
Instruction ID: 05cb00e2a448860a6f8e30a8236bdcdb349bcf866804e6035e8333a82530922c
Opcode Fuzzy Hash: d6f94197b1bc75d31b451af3ba042550fd673155e0dfa5d3c67621a4e2041656
Instruction Fuzzy Hash: B0314175A2061ADFDB55CFA4D45469EB7F2FF89300F108529E816EB350DB71AC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07098B80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4807b03ebbfa1e4419a7cede290c551a9d8c49f389732d9942c6666a66cf0f6
Instruction ID: 38378d6b7c572c724f00d0e10523e821b191f8c3c56099bf08c9c802dd5c4e73
Opcode Fuzzy Hash: a4807b03ebbfa1e4419a7cede290c551a9d8c49f389732d9942c6666a66cf0f6
Instruction Fuzzy Hash: 9C21B8B5E002069FDF10CFB9E950AAEBBF9EB49250F048139E900E7380E635D8818B95

Uniqueness

Uniqueness Score: -1.00%

Function 070910F8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509a0bb825d536854747d40f59b8c69cbbc113c1075478bd1aa8b16aa7bd93ac
Instruction ID: b9e72b16a635b2b239fbf22673a9acca96e37ab82e366b2ca81da27c9550b081
Opcode Fuzzy Hash: 509a0bb825d536854747d40f59b8c69cbbc113c1075478bd1aa8b16aa7bd93ac
Instruction Fuzzy Hash: D8314B74F1020BEBDF45CFA4D95469EBBB2BF89304F148629E815EB340DB709842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07091108 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac17ba8a9b164b16bfaa129aee4b421a8d2088e3f1daf5511634dda05ce414c
Instruction ID: 2264f8df323c632f359f6ef44867b5c02cdefa9f2c576ddbe8e1d342110a0ba7
Opcode Fuzzy Hash: cac17ba8a9b164b16bfaa129aee4b421a8d2088e3f1daf5511634dda05ce414c
Instruction Fuzzy Hash: C7213C74F1021BEBDB55DFA5D85069EF7B2BF89300F108629E815AB340DB719846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07098B90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c29c66528660e84516d9cfd3a560e99d241343a2b136fb7b90d169aa4a4967
Instruction ID: 2407759715935306cc9a1ed553c60631002cae2f7c99e7908e2550f5508772c1
Opcode Fuzzy Hash: d9c29c66528660e84516d9cfd3a560e99d241343a2b136fb7b90d169aa4a4967
Instruction Fuzzy Hash: C32186B5E11216CFDF00CFA9D980AAEBBF5EB88210F148139E905E7390E735DC808B94

Uniqueness

Uniqueness Score: -1.00%

Function 07090FF8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd66161d187f5a256ba8bdd2ae5334ffb5fbcf05cb5940c5e042779229bc75c
Instruction ID: 9ca567d543f489f04272ab66feb58f74751edf243a909e823ba80a6e44b87536
Opcode Fuzzy Hash: 9dd66161d187f5a256ba8bdd2ae5334ffb5fbcf05cb5940c5e042779229bc75c
Instruction Fuzzy Hash: 0721A775E0064ADBCF59DFA4D4506DEB7F1AF85350F20872AE811EB740DBB29946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0156D118 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2635081204.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_156d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd07cf453e38f46495fe3bc2a1241f3df96aa2864f8c4ced8aaaaf5918c11b4
Instruction ID: e947d7d03f47bf27175208137b5d5711230bb0dbf32547a2b2844467c8e337dc
Opcode Fuzzy Hash: 0bd07cf453e38f46495fe3bc2a1241f3df96aa2864f8c4ced8aaaaf5918c11b4
Instruction Fuzzy Hash: 7E210371604304DFEB01DF54D9C4B26BBB9FB84214F20C96DE8894F246C3BAD446CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0709BDE0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a75b2ede5e0c4be41c8665dab5f388748d45550d24864229b29b36cdb2c48d
Instruction ID: c28eb99bb64d1eac99ef54290b2cb9615684e0b473caca1014e2f647fdb960f6
Opcode Fuzzy Hash: 73a75b2ede5e0c4be41c8665dab5f388748d45550d24864229b29b36cdb2c48d
Instruction Fuzzy Hash: C821A1B5B111198FDF84DB69E85469EBBFBEF85220F148635E805DB380DB319C828B94

Uniqueness

Uniqueness Score: -1.00%

Function 07091008 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecec2c2b974a03cd1de3eb3daeec66e3afe1a6a76adf5581fa6d9818859d2e2e
Instruction ID: 0d3e60eae32391e9c04c0c9ccf87cfa771143056bada4cb15f886191c135700f
Opcode Fuzzy Hash: ecec2c2b974a03cd1de3eb3daeec66e3afe1a6a76adf5581fa6d9818859d2e2e
Instruction Fuzzy Hash: 32218070E0064ADBCF58DFA4D45059EB7F2AF89350F20872AE816FB380DBB29845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0709BDF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e31803d9eb1decbe2f43d1caf471da8c0d087b35195309bcd6bf9b8209e990
Instruction ID: c8954add10719eb5e3f3d0f2927ec20441ddbf9d6601ca1ba770a774440224b4
Opcode Fuzzy Hash: d1e31803d9eb1decbe2f43d1caf471da8c0d087b35195309bcd6bf9b8209e990
Instruction Fuzzy Hash: 0D219DB4B011198BDF84DB69E85469EB7FBEF85220F248635E909EB340DB319C818B94

Uniqueness

Uniqueness Score: -1.00%

Function 07098CA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc305cd054383c2c065e5017e53a5106efd46c5003ee323f9fc5344684db9e2
Instruction ID: d97ea058f2d0689d49425bb344dc1b77a836dfab7ed726a137aed41055d643c1
Opcode Fuzzy Hash: bfc305cd054383c2c065e5017e53a5106efd46c5003ee323f9fc5344684db9e2
Instruction Fuzzy Hash: EE118871B111298BDF949678D8146AF77EAEBC9710F008539D90AE7384DE35DC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 07098958 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0479eebb037aff1774322cb359e4cc81266fc9b54167c5b106b578990b39f615
Instruction ID: d1d95db675ad0c2dec4ce42503c199986ff68eb5ec5adf8734f2fddf1b63e47d
Opcode Fuzzy Hash: 0479eebb037aff1774322cb359e4cc81266fc9b54167c5b106b578990b39f615
Instruction Fuzzy Hash: D22113B1D01219AFCB00DF9AD885ADEFFB8FB48310F10862AE918A7340C3746544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07098ED8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6991b5fd20345bb8567055af01b7ba9c60df01c242fabb2b3d738b2abaa4e31c
Instruction ID: 300ff3ed1842d7e0964ff4ff42e3ce174f0a85467b7a1a93958f06bf594868e6
Opcode Fuzzy Hash: 6991b5fd20345bb8567055af01b7ba9c60df01c242fabb2b3d738b2abaa4e31c
Instruction Fuzzy Hash: 5901F1703041514FEBA29278D42532BBBD3DBC6610F14C93BF50ECB781EA2ACC024386

Uniqueness

Uniqueness Score: -1.00%

Function 0709FDD8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157579ea82ebfd8b1abc9de0b17d7a84ea23359a52118454681462d2f34be1ad
Instruction ID: f76fe7628d637d22d0a7c212979764d05ed947470ed31209e11651eb3aa5d3b8
Opcode Fuzzy Hash: 157579ea82ebfd8b1abc9de0b17d7a84ea23359a52118454681462d2f34be1ad
Instruction Fuzzy Hash: 6201D8F03083039BFF64367654D833A7AD49F4929CF040638DD57C6293EE98E840E261

Uniqueness

Uniqueness Score: -1.00%

Function 0156D113 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2635081204.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_156d000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: a991bced90c13cac6221f8f57fe3380871a76674d9879eb5326fde5c9ba91da7
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: B111BE75604284CFDB02CF54D9C4B19BBB1FB84314F24CAA9D8494F257C37AD44ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 07098960 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355eef9879c0e1176c1def8e9b8c3d71ce401ef1cd2bda20a7d623ec3de93b05
Instruction ID: 5579cd38c594788eafe8e9601b671fde5590d7806ec71106d682891307e83af6
Opcode Fuzzy Hash: 355eef9879c0e1176c1def8e9b8c3d71ce401ef1cd2bda20a7d623ec3de93b05
Instruction Fuzzy Hash: 1C11C2B1D01219AFCB00DF9AD884ADEFBB4FB49314F10852AE918A7340C3746954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0709F3E0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513b45b95d7bcadc60780f6fb54748a4c3d98fa4fdc19d136c6082ed4216a356
Instruction ID: 747de24be30fa9508861e973660c0df074ee8032d5bd161e35ca45147070fdcd
Opcode Fuzzy Hash: 513b45b95d7bcadc60780f6fb54748a4c3d98fa4fdc19d136c6082ed4216a356
Instruction Fuzzy Hash: 4301DF70B042168FDF91967CE850B2B77E6EB86610F10493AE10ECB350EF29EC818781

Uniqueness

Uniqueness Score: -1.00%

Function 07098EE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34632dec2978a66cfc3c2ef68a69d6e932fce549323fc99371604f79a6f77112
Instruction ID: 3f104e91cd42f1643c83a27e8a96bcac1d898c7f5f1bc3cc6c2623c968629cb8
Opcode Fuzzy Hash: 34632dec2978a66cfc3c2ef68a69d6e932fce549323fc99371604f79a6f77112
Instruction Fuzzy Hash: 74016D317101164FEFA4966DD46472BB2DBEBDAA20F10C93AF90EC7784EE66DC024395

Uniqueness

Uniqueness Score: -1.00%

Function 07098C90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007bcefbb006bb92983c63c8b55973b5bd88e319f94fddd6835a899e9b570120
Instruction ID: 62b2176de1c1fdf270da8eaed51172da521aebef9b50303b64cab5f22be56462
Opcode Fuzzy Hash: 007bcefbb006bb92983c63c8b55973b5bd88e319f94fddd6835a899e9b570120
Instruction Fuzzy Hash: B901A2B2B111554BDF989678EC153EF37EA9BC9211F00853AD90AE7380EF648C424B95

Uniqueness

Uniqueness Score: -1.00%

Function 0709F3F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0241e034dd6f76a065f5f66201260279681a8004bb9277366ba5f6582d0ab57f
Instruction ID: 94a7eca68c422740b7e84f10c248f4cefd770130620583d02a4152b1cd4b12a1
Opcode Fuzzy Hash: 0241e034dd6f76a065f5f66201260279681a8004bb9277366ba5f6582d0ab57f
Instruction Fuzzy Hash: 3A018C70B0011A4FDFA4967CE850B2BB3D6EB89B14F108939E50ECB350EF25EC818781

Uniqueness

Uniqueness Score: -1.00%

Function 0709D39F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916dde02e82cba235dc067adcc33f2f5a5c8261f2b517248343eba91e665a9a1
Instruction ID: 6a8597f30414680bfb863674af383c5257773bd810f8defffc15ee12121392b4
Opcode Fuzzy Hash: 916dde02e82cba235dc067adcc33f2f5a5c8261f2b517248343eba91e665a9a1
Instruction Fuzzy Hash: 24F0E2F5B64109CFDF248B05E5442AC77B1FB00322F1486B1D800E3180D374A9C2EB00

Uniqueness

Uniqueness Score: -1.00%

Function 0709B548 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba36d20edaee599ab8e13a0e6710bdade2e67cee3165b8a767a817738697809
Instruction ID: 497d19e6e7247674e07dbc8b0e97483bd4af055205344a13278b953e8cb59fb3
Opcode Fuzzy Hash: cba36d20edaee599ab8e13a0e6710bdade2e67cee3165b8a767a817738697809
Instruction Fuzzy Hash: 77E092F1E09109EFDF50CEB4E99539A3BD5DB41324F208AB9D408C7650E136CD519341

Uniqueness

Uniqueness Score: -1.00%

Function 0709B558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01286a41a581f462f2cd16cd00c9152f092291e3d396a91bfb7fb991edc7bf5d
Instruction ID: 8b2e7e8f0e6c647dbe9a222e2ca3f1a739405176038a70328ea14444079aa7c0
Opcode Fuzzy Hash: 01286a41a581f462f2cd16cd00c9152f092291e3d396a91bfb7fb991edc7bf5d
Instruction Fuzzy Hash: 3CE08CF0E00109EBDF50CAA4998575A73ECD741324F208AB8D408C7200E572DE01A780

Uniqueness

Uniqueness Score: -1.00%

Function 0709FDA1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2672512416.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7090000_hesaphareketi_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8606e1cfe6495518abb2919256ed2ac919239626f4acf01254975954878b5a
Instruction ID: 00949fc3e14f5f8e60b79f80b7ac186dd880b60e8e8d6c889a83d6c956d94a83
Opcode Fuzzy Hash: 7f8606e1cfe6495518abb2919256ed2ac919239626f4acf01254975954878b5a
Instruction Fuzzy Hash: 36C0805540D2615FE7011F3054017DA3B30EB11291F0B02C3D541FB063C61CCA5DE7B6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 4152, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	71
Total number of Limit Nodes:	7

Executed Functions

Function 0121C7B0 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0121C83E
GetCurrentThread.KERNEL32 ref: 0121C87B
GetCurrentProcess.KERNEL32 ref: 0121C8B8
GetCurrentThreadId.KERNEL32 ref: 0121C911

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d726587dfe018ba3898a857bb9348323f49d963c73e9f085821bdbbec87ba8d7
Instruction ID: 12aa18a1458c4c927046d878c7fe24a9963ecce68aac391aa00899d925372f8a
Opcode Fuzzy Hash: d726587dfe018ba3898a857bb9348323f49d963c73e9f085821bdbbec87ba8d7
Instruction Fuzzy Hash: 5F5166B094034A8FEB18DFAAD548BAEBFF1BF88314F208459D509A7390D7346944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0121C7C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0121C83E
GetCurrentThread.KERNEL32 ref: 0121C87B
GetCurrentProcess.KERNEL32 ref: 0121C8B8
GetCurrentThreadId.KERNEL32 ref: 0121C911

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 19088e614125e664cde95ed0c5c543f616e49dc5f376467c25ba136249f994ac
Instruction ID: 78c53ff10cf17301188544151c96948a774136fa8b2fcd461dd629d8df592810
Opcode Fuzzy Hash: 19088e614125e664cde95ed0c5c543f616e49dc5f376467c25ba136249f994ac
Instruction Fuzzy Hash: 255167B095034A8FEB18DFAAC548BAEBBF1FF88314F208459D409A7350DB346844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0121A528 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0121A77E

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5d4342294d43776796010591df30227d5d4e1c20e56eddd6261438b54d779815
Instruction ID: 9c20e6132ae683b1c46ed8e91459c6a6d83aeb5b1a64a05b243117619f90839d
Opcode Fuzzy Hash: 5d4342294d43776796010591df30227d5d4e1c20e56eddd6261438b54d779815
Instruction Fuzzy Hash: 6D716970A11B468FEB29CF29D45079ABBF1FF98704F00892DD58AD7A44D774E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0121CE09 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121CE97

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8fd7ded2ba193652969cc809f2cab06cfa8002b862e36a6230927ad4aeed4d50
Instruction ID: 693882e0a5da7a4b6ad147c813766343536aaf1eb023ee71fe5318a0baa522c6
Opcode Fuzzy Hash: 8fd7ded2ba193652969cc809f2cab06cfa8002b862e36a6230927ad4aeed4d50
Instruction Fuzzy Hash: 9E2103B5D002499FDB10CFAAD884AEEBFF5FF48310F14841AE958A3210C375A955CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0121CE10 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121CE97

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9131730166e2e0574d87b798dcca4048486e404fc83d80764203f677f478dcab
Instruction ID: 5b9a0e7c4ada48223553aa2e70564fa221090cf73903b351b262e2a8ec83ad77
Opcode Fuzzy Hash: 9131730166e2e0574d87b798dcca4048486e404fc83d80764203f677f478dcab
Instruction Fuzzy Hash: 6421C4B59003499FDB10CFAAD884ADEBBF9FB48310F14841AE958A3350D375A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0121A998 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0121A7F9,00000800,00000000,00000000), ref: 0121AA0A

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 461d9da28f99f05adf6cad342ee9f95194d4771add7a73adf1e48834d81efc2e
Instruction ID: c6e061956e5da8ca654f6b7d3b77b5952fcafdc8a6b712a78751777724687bcf
Opcode Fuzzy Hash: 461d9da28f99f05adf6cad342ee9f95194d4771add7a73adf1e48834d81efc2e
Instruction Fuzzy Hash: 0B1117B6C003498FDB20CFAAC585ADEFBF5EB98310F20851ED555A7600C375A546CF64

Uniqueness

Uniqueness Score: -1.00%

Function 012198B0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0121A7F9,00000800,00000000,00000000), ref: 0121AA0A

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e1bb40acae0c0e875efaf1c8f261e5b2306dfbc907083772b5c58b7ac9b2f03b
Instruction ID: b5ca9b0b4931edb5ad0ada6610c4318874d242b09c6c6b402337100718026178
Opcode Fuzzy Hash: e1bb40acae0c0e875efaf1c8f261e5b2306dfbc907083772b5c58b7ac9b2f03b
Instruction Fuzzy Hash: 651114B68003498FDB10CF9AC444BDEFBF5EB98320F10842ED519A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0121A718 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0121A77E

Memory Dump Source

Source File: 00000006.00000002.1568759827.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1210000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 817fc2243e2c63fc904d3b3e3e3292aea9072d1ff99b304e1d00b6e9c870f551
Instruction ID: 7630e48a2f018a5c0c308e817b702f4d3fb520f3229ebb141af0e141e1ff441d
Opcode Fuzzy Hash: 817fc2243e2c63fc904d3b3e3e3292aea9072d1ff99b304e1d00b6e9c870f551
Instruction Fuzzy Hash: 8711DFB5C013898FDB24DF9AC444B9EFBF5AB88624F10842AD519A7610C379A646CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011BD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1568408295.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11bd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fda3399dd5fe92bb49afb61008a11d2bcf41aee8b65ecd46e5b04b5ecb0a790
Instruction ID: ff480fdbddd2d668a455711c1e7616fa056f8caa54853a99cf0c92c513c69fe5
Opcode Fuzzy Hash: 9fda3399dd5fe92bb49afb61008a11d2bcf41aee8b65ecd46e5b04b5ecb0a790
Instruction Fuzzy Hash: 45212471604204DFDF0DDF44E8C0B56BF61FB84328F20C169E9090A256C33AD446CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1568512673.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11cd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd80166f164e46a1b2822bf01096439e38d99b19ac6f69407effb44e4af6f2f
Instruction ID: 080732a9d499cb75661bcd14bb03dab9f5c495aab18b33ab2538c130a030b3fa
Opcode Fuzzy Hash: ecd80166f164e46a1b2822bf01096439e38d99b19ac6f69407effb44e4af6f2f
Instruction Fuzzy Hash: 28210375604300DFDF19DF58E884B16BB61FB94A14F20C57DD84A0B246C336D417CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 011CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1568512673.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11cd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7575b19acbc9a2895972a94c2119591a9be7a61fcdf62255e399b82abc8d58
Instruction ID: 3c89cb2cb76bfce08b6ceba68f6ee727a1fd681a1cf33986ccc751426ddba595
Opcode Fuzzy Hash: 1a7575b19acbc9a2895972a94c2119591a9be7a61fcdf62255e399b82abc8d58
Instruction Fuzzy Hash: 8C2192755083809FCB07CF58D994715BF71EB46214F28C5EED8498F2A7C33A9816CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011BD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1568408295.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_11bd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 75d25f0663580d12cc00b0d75b10cd142cc4a9d8bebd23623af2a353e2f61f27
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 5E11DF76504240CFCF0ACF48D5C0B56BF72FB84328F2481A9D9094B257C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4276, Parent PID: 4152COMMON

Executed Functions

Function 04A44C20 Relevance: 2.6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

]n^, xrefs: 04A44CDA
]n^, xrefs: 04A44CEA

Memory Dump Source

Source File: 00000007.00000002.1587458961.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID: ]n^$]n^
API String ID: 0-1445656537
Opcode ID: 017f8fea41743c9ac6a177506ee97b49f480ab2e8af93b86c14a1a7bc9518843
Instruction ID: 3aa9bdb87307f2c92139dd801bf90c5d9a3949f0d05003f2ea59b02868a04133
Opcode Fuzzy Hash: 017f8fea41743c9ac6a177506ee97b49f480ab2e8af93b86c14a1a7bc9518843
Instruction Fuzzy Hash: 4A318474A093969FCB02DF6CC89459EBFB0BF8A210B0944DAD485DB393C724E806C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 07781C10 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1605286934.0000000007780000.00000040.00000800.00020000.00000000.sdmp, Offset: 07780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7780000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966c29359b2cef99d07e245219d4a15443d6049224d19f502055586e1e884860
Instruction ID: acf6b8bd6362272b8fd85feb3e85cf5935c62e8d106f975ffdd301e68bfee21b
Opcode Fuzzy Hash: 966c29359b2cef99d07e245219d4a15443d6049224d19f502055586e1e884860
Instruction Fuzzy Hash: EB126CB1B443158FC755AB68D8017AABFA2AFC6252F14C87FD905CB652DB31CC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A429F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1587458961.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbd45bb4804888b5928cc817e5d2bb36b03e47338dc06421eeb24ca786a3eae
Instruction ID: 8d0717798cefa8462fb06449cc7f5c5f93d06cff66438cbc092c8e9f2a8b36a7
Opcode Fuzzy Hash: 1cbd45bb4804888b5928cc817e5d2bb36b03e47338dc06421eeb24ca786a3eae
Instruction Fuzzy Hash: C7918D75A002058FCB15CF59C494AAEFBB1FFC9310B2585A9E815AB3A5C735FC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07781BF0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1605286934.0000000007780000.00000040.00000800.00020000.00000000.sdmp, Offset: 07780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7780000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc6a472a6f70c5f9bdfca7a111d5bcafaddd51e6ef1c7b0ef2d96ef15f4f8a1
Instruction ID: 3c3cab0fc84609ab1fe7cea51d0f272773fe08008ffc18e740058e25aceaa6dd
Opcode Fuzzy Hash: 7cc6a472a6f70c5f9bdfca7a111d5bcafaddd51e6ef1c7b0ef2d96ef15f4f8a1
Instruction Fuzzy Hash: B241F6F1A40305DFCB65AF15C905BB97BA2AF86294F54C8AED9009F652C732DC42C771

Uniqueness

Uniqueness Score: -1.00%

Function 04A42B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1587458961.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c685b2bbdbaf7eb0744ad0048946c712b9357789dc17cd51c70ebcae9db45f6
Instruction ID: f23cb698428a3b141c78b2d9f1d0b910c08f7dda13f4032680d6d0d4823ff291
Opcode Fuzzy Hash: 5c685b2bbdbaf7eb0744ad0048946c712b9357789dc17cd51c70ebcae9db45f6
Instruction Fuzzy Hash: E8415B75A006058FCB05CF59C4D8AAEFBB1FF88314B158599E815AB364C736FC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A44C10 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1587458961.0000000004A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff7839cc19ecc642bca9995b344b8c05af48204c40ab27153b839140810a4a3
Instruction ID: b3f72c0679dad2a667c96fb72f8a602c2607c8d02e70f510c603154425fc2618
Opcode Fuzzy Hash: 5ff7839cc19ecc642bca9995b344b8c05af48204c40ab27153b839140810a4a3
Instruction Fuzzy Hash: E021EA74A042598FCB00CF98D480AAEFBB1FF8D314B158599E815AB352C731FC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0313D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1586450785.000000000313D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0313D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_313d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289873c1c97232cb50cf33a7c4d65d471d73b2ae08b54eeb208cb125fb767a84
Instruction ID: 8a70ca53fd663408cc10e77a4a6446ca527ae10c2168cdb7b9e53707cc86e844
Opcode Fuzzy Hash: 289873c1c97232cb50cf33a7c4d65d471d73b2ae08b54eeb208cb125fb767a84
Instruction Fuzzy Hash: 8501807100D3C09FD7128B259C84752BFA8DF47624F1980CBD8888F193C2685C44CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0313D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1586450785.000000000313D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0313D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_313d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4634395769ef78126ea91b38f3fb433c43005023c8937cb83dd293985ab417
Instruction ID: 6dd6d2c3f318c06c80246fcea361690b778f2113e3acd0e31164a32209f2ec29
Opcode Fuzzy Hash: ca4634395769ef78126ea91b38f3fb433c43005023c8937cb83dd293985ab417
Instruction Fuzzy Hash: 7301F7714043049BE7108A21DC80BA7FF98DF4AB35F18C059EC085B182C7789441CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07781270 Relevance: 5.5, Strings: 4, Instructions: 486COMMON

Download Yara Rule

Strings

l, xrefs: 07781365
l, xrefs: 07781357
l, xrefs: 07781800
l, xrefs: 0778180E

Memory Dump Source

Source File: 00000007.00000002.1605286934.0000000007780000.00000040.00000800.00020000.00000000.sdmp, Offset: 07780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7780000_powershell.jbxd

Similarity

API ID:
String ID: l$l$l$l
API String ID: 0-2658161240
Opcode ID: 6ef2acfb979412f8fbc43fb28f6e7b341dec85998193e564817d563c70cd67e3
Instruction ID: 40248d5acfc305c987f363e70ce7dc6032a2c3d99c30a22eb38346823cada6b7
Opcode Fuzzy Hash: 6ef2acfb979412f8fbc43fb28f6e7b341dec85998193e564817d563c70cd67e3
Instruction Fuzzy Hash: 8EF15AB17442098FD754AB68D4017AABBE2AFC6361F58C87ED84ACB651DB31CC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 5296, Parent PID: 4152COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	98
Total number of Limit Nodes:	11

Executed Functions

Function 06C75598 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06C7590E

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 52efa5fc64131a8eec4742c3a005a184389afa585c09d240319b0410534ae80a
Instruction ID: 0bd7db9b7c5ece8627d5ea4f183d7af38749e3f71ac0572282f318459dd2e7b0
Opcode Fuzzy Hash: 52efa5fc64131a8eec4742c3a005a184389afa585c09d240319b0410534ae80a
Instruction Fuzzy Hash: 4222A075E102158FDF64DBA4C4806AEBBB6FF89310F64846AD809EB385DB35ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06C72760 Relevance: 1.5, Instructions: 1491COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5c90410f253e4fb2f7db68273cd6e7258fa2f1f5570c5dbdaaf50a6cc1ff1f
Instruction ID: f28aaa56a57b461aabfa0ca3e1a66a7b71fee28eef11f2799c0473c4e2ae6bab
Opcode Fuzzy Hash: bd5c90410f253e4fb2f7db68273cd6e7258fa2f1f5570c5dbdaaf50a6cc1ff1f
Instruction Fuzzy Hash: A7D27D30E00219CFDB64DB68C584AADB7B2FF89310F54C5AAD449AB351DB75EE81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06C765E0 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814d302580d6e007e099833d0e707afc050a6de4e6f8530c2c0aaff5f24e4e5e
Instruction ID: 2d8ba7f113360f878d1a082b88c68175702061149a1fd055b333ab98e1647038
Opcode Fuzzy Hash: 814d302580d6e007e099833d0e707afc050a6de4e6f8530c2c0aaff5f24e4e5e
Instruction Fuzzy Hash: 5A628B30B006098FDB54DB69D594BAEBBF2EF85310F148469E806EB390DB76ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06C7C580 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b0eb4a001f1923c41dfcc7b41cf7e362760fe7c8925d68b7f6997974654b9c
Instruction ID: c13909a2670dbf058ab894e6408679ef5bf119fb55e29caf6b1a6b7018d74416
Opcode Fuzzy Hash: b2b0eb4a001f1923c41dfcc7b41cf7e362760fe7c8925d68b7f6997974654b9c
Instruction Fuzzy Hash: B2329434B1020A9FDF54DB69D994BAEB7B2FB88310F208529E415EB380DB75ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C7B230 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf22c3f14333cc80a59d3b04f9989cc8984d08acf05ba20bf71ad3b29463fe6b
Instruction ID: 7de2dcfc5903aff848c15d2bdc0c75108067559852bf26bcf87a5e4551aa4d60
Opcode Fuzzy Hash: cf22c3f14333cc80a59d3b04f9989cc8984d08acf05ba20bf71ad3b29463fe6b
Instruction Fuzzy Hash: 66226F30E102098FEFA4CF68D5947ADB7B6EB89310F64842AE419DB391DB35DE81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06C77D70 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb6f1f6f663df588bf6902b10e3cffc37d51453b88699fbd56f78512644f732
Instruction ID: 012504599fa1d1c21318d5f35ddea23a4c0d0aecd750eec51da7377927e5d733
Opcode Fuzzy Hash: 6bb6f1f6f663df588bf6902b10e3cffc37d51453b88699fbd56f78512644f732
Instruction Fuzzy Hash: F002AF30B012198FDB54DB69D8987AEB7E2FF84310F148569D906DB384DB76ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06C53200 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06C5328E
GetCurrentThread.KERNEL32 ref: 06C532CB
GetCurrentProcess.KERNEL32 ref: 06C53308
GetCurrentThreadId.KERNEL32 ref: 06C53361

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1d7a00df65619ca2a70100a57043970893f5c377ff606ac7b1901d0aa948e632
Instruction ID: 2da93cf3a9e14858e91e43626c86ad44064f3fdf60fb363097ee436ea9dc9ff3
Opcode Fuzzy Hash: 1d7a00df65619ca2a70100a57043970893f5c377ff606ac7b1901d0aa948e632
Instruction Fuzzy Hash: 9B5165B0900749CFDB54DFAAC988B9EBBF1FF88314F208059E409A7250DB745985CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 06C53210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06C5328E
GetCurrentThread.KERNEL32 ref: 06C532CB
GetCurrentProcess.KERNEL32 ref: 06C53308
GetCurrentThreadId.KERNEL32 ref: 06C53361

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aee14aeb56143dd73d8820b4d0361e78735b24b7f3f3464336d88c58cabf1091
Instruction ID: bc19292d03d9be0ca9c4826cc2cc178553ba039e57402a6f65a7709e82f6285b
Opcode Fuzzy Hash: aee14aeb56143dd73d8820b4d0361e78735b24b7f3f3464336d88c58cabf1091
Instruction Fuzzy Hash: 165146B0900749CFDB54DFAAD988B9EBBF1FB88314F208019E409A7250DB746984CF69

Uniqueness

Uniqueness Score: -1.00%

Function 06C5B718 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06C5B97E

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 63dfa94bbfcc104c9d62fbd957b7fc06996dd376b457c4ae5b9e4349dccb7b04
Instruction ID: 26a475ac45a15cb69fbec35f96e74396f9eedd71fdc219f62d9258b27b6ff027
Opcode Fuzzy Hash: 63dfa94bbfcc104c9d62fbd957b7fc06996dd376b457c4ae5b9e4349dccb7b04
Instruction Fuzzy Hash: A7818970A00B058FD764DF2AC85575ABBF1FF88204F00892ED88AD7B40DB75E985CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C5D904 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06C5DA22

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d38a72a5f6294f2be04a63ac44069e7f8b94a775143e9a56968068c0c47f243b
Instruction ID: 7b820f34bd0c93b47d4924c4e5da53da2264fb85278f2a2af833d0d87f362199
Opcode Fuzzy Hash: d38a72a5f6294f2be04a63ac44069e7f8b94a775143e9a56968068c0c47f243b
Instruction Fuzzy Hash: CD51C3B5D00349DFDB14CF99C884ADEBFB5BF88310F25812AE819AB210D771A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06C5D910 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06C5DA22

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 688649c58ca68db7f2db9cc133f94a66a05aa99b8a1b06388a6010f21e40e40f
Instruction ID: ca9cf9be4db4c46130a9b135470cf86ea9242abfed2daad5c84a994e8e264344
Opcode Fuzzy Hash: 688649c58ca68db7f2db9cc133f94a66a05aa99b8a1b06388a6010f21e40e40f
Instruction Fuzzy Hash: AB41B0B1D00309DFDB14CF9AC884ADEBBB5FF48310F25812AE819AB210D775A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 071E0C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 071E0D31

Memory Dump Source

Source File: 0000000B.00000002.1685924792.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71e0000_cbsBVT.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7b222aabbe3cbadcb81cff767e862480eadc1a41599831bc5a8327bd6b809b4f
Instruction ID: 19e946a6f3ff22d1fe979090c6bbbd922a1b78d639d5f67d003104c0837d3e6d
Opcode Fuzzy Hash: 7b222aabbe3cbadcb81cff767e862480eadc1a41599831bc5a8327bd6b809b4f
Instruction Fuzzy Hash: 264149B4900709CFCB14CF99C848AAABBF5FB88314F258499D419AB361D775E841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06C53450 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06C534DF

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b00bbbd10f30e0b1c6dca8ced31892aa09bb3ea34212aee6c1bbc1fd1880bea4
Instruction ID: 24bec9108bcb81f9f2ed4d75e41b65b95a1f98496bd7ec0dc5b51e0bae56c947
Opcode Fuzzy Hash: b00bbbd10f30e0b1c6dca8ced31892aa09bb3ea34212aee6c1bbc1fd1880bea4
Instruction Fuzzy Hash: 2021E3B5D003499FDB10CFAAD884ADEBBF9FB48310F14805AE919A7350D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C53458 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06C534DF

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 712a67b3272bd54482e7436fe316b5f59ff4784c51f8b4907aefac51526fc5cd
Instruction ID: 4b99061b4cb1ef8a85e70aadd3cf26350c8c1ac5ee5ee721b17ab1661ca41e93
Opcode Fuzzy Hash: 712a67b3272bd54482e7436fe316b5f59ff4784c51f8b4907aefac51526fc5cd
Instruction Fuzzy Hash: 5221E3B59002499FDB10CFAAD884ADEBBF8FB48310F14801AE918A7350D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C5BB79 Relevance: 1.6, APIs: 1, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06C5B9F9,00000800,00000000,00000000), ref: 06C5BBEA

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e5213175593aa72864aabad7d6b430139c49b36b58092b9cd7d0f01157d00b2b
Instruction ID: b1f152048262ff4c698e1f5cb958182b593970b56f0d77324eba31a7bc43dae4
Opcode Fuzzy Hash: e5213175593aa72864aabad7d6b430139c49b36b58092b9cd7d0f01157d00b2b
Instruction Fuzzy Hash: 901103B6C003099FDB14DF9AD884ADEFBF9EB88310F11841EE819A7240C7B5A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C5A710 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06C5B9F9,00000800,00000000,00000000), ref: 06C5BBEA

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: abca1ee9b62841622d203e845d9d7b19c5e8d635ec0cc6121ed1a1b41f56b094
Instruction ID: acf866fcfd65103e0c90eba49b630db2a8853100775088cd24648038e3428b2c
Opcode Fuzzy Hash: abca1ee9b62841622d203e845d9d7b19c5e8d635ec0cc6121ed1a1b41f56b094
Instruction Fuzzy Hash: C51117B6C003098FDB10DF9AD884B9EFBF4EB49310F11842EE919A7210C3B5A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 013CE75C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,013CEFA2), ref: 013CF08F

Memory Dump Source

Source File: 0000000B.00000002.1656177884.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13c0000_cbsBVT.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a3c4d06d499d0adb6d2494fdea7b858c25327d8f87771da16068d0124831a742
Instruction ID: cc7027f538e5319e504f234970b622155816c1fd7053078d045b561a8d2b13db
Opcode Fuzzy Hash: a3c4d06d499d0adb6d2494fdea7b858c25327d8f87771da16068d0124831a742
Instruction Fuzzy Hash: 561136B1C0065A9BDB10DF9AC44479EFBF8BB48614F10816AE914A7240D378A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 013CF024 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,013CEFA2), ref: 013CF08F

Memory Dump Source

Source File: 0000000B.00000002.1656177884.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_13c0000_cbsBVT.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c9ff128d6389c49e21fad0c53026e3046a7b264577ddb9e2872e0d4759cf104e
Instruction ID: 8c10b2aae136d53a760ab952e6ab87f7b545a5cec70e2b588005a347d71aae89
Opcode Fuzzy Hash: c9ff128d6389c49e21fad0c53026e3046a7b264577ddb9e2872e0d4759cf104e
Instruction Fuzzy Hash: 6D1126B1C0065A9FDB10DF9AC4447DEFBF4BF48724F11816AE818A7240D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06C5B918 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06C5B97E

Memory Dump Source

Source File: 0000000B.00000002.1683692594.0000000006C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c50000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d73755fcb13b1e8a48c8b9eb66de26e953afe2ef29613f8bd6e8e1361e266b71
Instruction ID: 0f2e32675b3ce02951363e8c901de3fbac097a53b934f67cf7f2ca03dbb4833e
Opcode Fuzzy Hash: d73755fcb13b1e8a48c8b9eb66de26e953afe2ef29613f8bd6e8e1361e266b71
Instruction Fuzzy Hash: F21113B5C003498FCB10DF9AC844BDEFBF4EB88214F11841AD859A7210C379A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 071E32E0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 071E333D

Memory Dump Source

Source File: 0000000B.00000002.1685924792.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71e0000_cbsBVT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0b5880c449bc4b1231812d870cbf6dea17d5ec5395c31525a8fa42180c5d469d
Instruction ID: 65db161a5fa4358421a1d392b2fbea3c2c5d966aa2afb95b471a2c7e9bdaa63c
Opcode Fuzzy Hash: 0b5880c449bc4b1231812d870cbf6dea17d5ec5395c31525a8fa42180c5d469d
Instruction Fuzzy Hash: 961127B58007498FCB10DF9AD444BCEFBF8EB48324F248419E559A7340D778A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 071E2400 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 071E333D

Memory Dump Source

Source File: 0000000B.00000002.1685924792.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71e0000_cbsBVT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f5ecc6a7f2af6cd7ee0111342a25f4f6b440aa16857184b578d4393fb06e067b
Instruction ID: 0c6ae1998da56b9f2afc73b96f208122dd6e50dab1dc5f0dd727cf6a0172e1e5
Opcode Fuzzy Hash: f5ecc6a7f2af6cd7ee0111342a25f4f6b440aa16857184b578d4393fb06e067b
Instruction Fuzzy Hash: CC1145B58007498FCB20DF9AD444B9EFBF8EB48220F208419E569A7340D778A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06C7D338 Relevance: .8, Instructions: 801COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2362b12704c06d22ed825918a614f6549964859a80da1b2c5f6c268b855374e
Instruction ID: 939fef68ffc2a4bd9351165851288d3ffe8bdc653c9b30dc50fd90fe8b07cef0
Opcode Fuzzy Hash: c2362b12704c06d22ed825918a614f6549964859a80da1b2c5f6c268b855374e
Instruction Fuzzy Hash: 87624D30B1030A9FDB55DB68D580A5DB7B2FF84304F208A69D40A9B358DB76FD46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C7ACC8 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7a2180944fc57eb239112c455112872a830956d5765fac22b13e15745e2a8d
Instruction ID: 04627bc528a2820a934df8418fec70864dc79179fa7ecc2e01b07e4e8b05dc9d
Opcode Fuzzy Hash: cf7a2180944fc57eb239112c455112872a830956d5765fac22b13e15745e2a8d
Instruction Fuzzy Hash: 62E16E30E102199FDB68DFA9D8906AEB7B2FF89301F208529D815DB244DB75ED46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C7B21F Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb525dcc82889b9baf7b7cbd75634d0a0fbd0abffe2dd6886c3e53fe25278c5c
Instruction ID: 5c4cff0c5cd099f0bdb9a6ca5c71a6f7194818b0aabd6e7922baa7a5c1a45d9b
Opcode Fuzzy Hash: bb525dcc82889b9baf7b7cbd75634d0a0fbd0abffe2dd6886c3e53fe25278c5c
Instruction Fuzzy Hash: E2A18530E012099BEFA4CFADD9947AEB7B6EB89310F608429E405E7391CB35DD819751

Uniqueness

Uniqueness Score: -1.00%

Function 06C7B628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd25fe91600a290ab321a7d8a8043c591f84ac1493fb383e78f434c945df5a5
Instruction ID: d32f28b0272685bc0e909a79acadf2126ab97ee4fcb8cde37c36f6bdaf4fff70
Opcode Fuzzy Hash: 7bd25fe91600a290ab321a7d8a8043c591f84ac1493fb383e78f434c945df5a5
Instruction Fuzzy Hash: C7A14930E102098FDBA4CF68D584BADB7B2FB45310F24856AE469EB351D735EE81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C79140 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e62234d6ef380f425f9ff53b2a9ac833d82316841e2a76452fd126db1dfbaf
Instruction ID: f5f75b897748ae8f772818cc691e965b063c3de084e551b166a665d0b1261ad6
Opcode Fuzzy Hash: 54e62234d6ef380f425f9ff53b2a9ac833d82316841e2a76452fd126db1dfbaf
Instruction Fuzzy Hash: 7C913E30B1021A8FDB94DB79D8507AEB7B6FFC9200F108569C81AEB344EB75DD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C761E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a148a90476203be94ad43cc5d1c1a8b491e9623b3fe437664b9cd5e126221578
Instruction ID: 0a511984191a645566f90e5417a30748ec83a3f743ead7d4d7e91b889ca03027
Opcode Fuzzy Hash: a148a90476203be94ad43cc5d1c1a8b491e9623b3fe437664b9cd5e126221578
Instruction Fuzzy Hash: B161D471F005214BDF54AA7EC884A6FBADBEFC4610B15403AD80ADB3A0DEB5ED4287C5

Uniqueness

Uniqueness Score: -1.00%

Function 06C74298 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16cc4778902d0dc457566a71489ccb5412868f75aa736d97887733a7238e8e94
Instruction ID: 0a7aee1fdca0999636f079b0c5b81dee9a932b62e3ef77ab7e8a67c140a45477
Opcode Fuzzy Hash: 16cc4778902d0dc457566a71489ccb5412868f75aa736d97887733a7238e8e94
Instruction Fuzzy Hash: 23812E30B112098FDB98DFA5D4547AEBBF6AF89300F148529D40ADB384DB75DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C742A8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6055f0a3142d64a218f5371536e50c2d02954d8c377bcdb5a5d1759cbae43d9a
Instruction ID: 382f6d4475ff5a14bce44066269f2211a75cc1d0a3cc6488e18bc7d70edc55f6
Opcode Fuzzy Hash: 6055f0a3142d64a218f5371536e50c2d02954d8c377bcdb5a5d1759cbae43d9a
Instruction Fuzzy Hash: 50811E30B112098FDB98DFA9D4547AEBBF6EF89300F148529D80ADB384DB75DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C745BC Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbcc8840c7e0e9656bfa827eb1475cee83dbc8e7e26b5c3f7b8509c07c93011
Instruction ID: 5afac64e75c897863ed9d60f6e390dcb426f1ea325f5058cfb78d52481758281
Opcode Fuzzy Hash: ebbcc8840c7e0e9656bfa827eb1475cee83dbc8e7e26b5c3f7b8509c07c93011
Instruction Fuzzy Hash: 2E913B30E106198BDF64DF68C880B99B7B1FF89304F20C699D549EB285DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06C745D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19cc7b5b66cb8441fdb7768cdbb312c868cc636be06192e3492eaf7a5441308
Instruction ID: 83c90d9c8735bb9b9f3e433a6f6b399b67b862dbc4fb2197fddec1fb42c071cc
Opcode Fuzzy Hash: b19cc7b5b66cb8441fdb7768cdbb312c868cc636be06192e3492eaf7a5441308
Instruction Fuzzy Hash: FD912B30E106198BDF64DF68C880B9DB7B1FF89314F20C699D509BB244DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06C7EF00 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4322f6a246e9df68c8e7104c6492496ace045bdea27116338cd65774d1d234f0
Instruction ID: d7ccfa94d59b9a6362ea8eee6a4426cce2baa06c8ec82a5395a5170e4d682e14
Opcode Fuzzy Hash: 4322f6a246e9df68c8e7104c6492496ace045bdea27116338cd65774d1d234f0
Instruction Fuzzy Hash: 26715971A002099FDB54DFA9D980AAEBBF6FF88310F248469D419EB354DB30ED46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 06C7EF10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34eee947b802de510784db6ec7020d8c420c478bbfaa242d1633ea043dae713f
Instruction ID: 8bfe1b1283aa4abc61300318671c6525e433f0c0c79186d40e9d494060ef3fe7
Opcode Fuzzy Hash: 34eee947b802de510784db6ec7020d8c420c478bbfaa242d1633ea043dae713f
Instruction Fuzzy Hash: C3713B71B002099FDB54DBA9D980A9EBBF6FF88310F248469D419EB354DB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06C74B68 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c65a6ec26d3c53b2b0eafe8e1c032f705a0ee319495df73e13dfb16910ae6c6
Instruction ID: ea28a9aecc5c75b290a8d8c3ebed768231a08de7480aa5a468740e29af3f42a8
Opcode Fuzzy Hash: 8c65a6ec26d3c53b2b0eafe8e1c032f705a0ee319495df73e13dfb16910ae6c6
Instruction Fuzzy Hash: 76617270F002099FEF589BA9C8547AEBBF6FF88300F208529E505AB394DFB55C458B95

Uniqueness

Uniqueness Score: -1.00%

Function 06C7FC78 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8282321f59146d1b43a60f3c84285def3bcc4a5ace177934ffef329900b9b5
Instruction ID: 4a261de16b0e326cd7f5f3ff06a34a04625d59095463bb19dcb5b6e15b8ca44f
Opcode Fuzzy Hash: 8b8282321f59146d1b43a60f3c84285def3bcc4a5ace177934ffef329900b9b5
Instruction Fuzzy Hash: EE51CF31E00209DFDF64EFB8E4846ADBBB2FB84215F10886EE526D7250DB359E55CB84

Uniqueness

Uniqueness Score: -1.00%

Function 06C7FA18 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9494b6afd47fc9d85b796f5a00b1d7a716d5020971c3ce2eb327c98cd8898e0
Instruction ID: 360e0800440f49b9183603e59cf98bdad75ea7706b779ddaceffac8039dd79aa
Opcode Fuzzy Hash: c9494b6afd47fc9d85b796f5a00b1d7a716d5020971c3ce2eb327c98cd8898e0
Instruction Fuzzy Hash: 8051E270B202049BFF64566CD994B6E7A9AE7CD710F60442EE41BC7390CF6DCE4193A2

Uniqueness

Uniqueness Score: -1.00%

Function 06C79131 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de076a9308b292449e1624affaace9e927d2b971c0b7c9c9fbafc885471a5701
Instruction ID: 17f684790a182603eafdb131ae0e6f96b5b44b6b215ec67d3e761a8509ffc1cc
Opcode Fuzzy Hash: de076a9308b292449e1624affaace9e927d2b971c0b7c9c9fbafc885471a5701
Instruction Fuzzy Hash: 55514F30B0114A9FDB94DB79D860B6E77F6EFC9200F108569D80ADB385EA35DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C7FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0ead9597bbc1e9ac4b4ea88f9c3ecf90e86a4211cdef9acd28e678e0f731ee
Instruction ID: eec24e7df7d9149167601e6db61fc6a9deaccd0d41d6ffa65c77e7116cb2bf35
Opcode Fuzzy Hash: 2e0ead9597bbc1e9ac4b4ea88f9c3ecf90e86a4211cdef9acd28e678e0f731ee
Instruction Fuzzy Hash: BE51F070B202049BFF64566CC994B6E7A9AE7CD710F60442EE41BC7390CF6EDE4193A2

Uniqueness

Uniqueness Score: -1.00%

Function 06C74B58 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4108de943a58638a8a8b08b4205f49528f7c4c94bb960da5b0b65c0538a1ffa
Instruction ID: 3bd25e5807c8fa237240a5842fb0f26728302a608dce4c6e12ef733b9cb1c669
Opcode Fuzzy Hash: a4108de943a58638a8a8b08b4205f49528f7c4c94bb960da5b0b65c0538a1ffa
Instruction Fuzzy Hash: E1515070F002089FEB589BA5C8547AEBAF6FF88300F208529D505AB394DA759C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C75420 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c47a493be1d21e620099f566a913a279617debe0843fe5eb0a752e32d5b135
Instruction ID: ecc09eb5ea7d235c6f9f4130f79bfcf4375fead61f84b2123c954e6efecfbf12
Opcode Fuzzy Hash: 61c47a493be1d21e620099f566a913a279617debe0843fe5eb0a752e32d5b135
Instruction Fuzzy Hash: 55415C71E006098FDF70CFA9D880AAFF7B6FB84310F50492AE21AD7650DB30E9559B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C7DEC0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff3c911b6417ffb54100031f902ace47520fc0173b042ebdcf8bd83f878b67d
Instruction ID: abfe23e321b9e3fe54a13cb0e3069fdb318f5235d0675cb22f6a849d6d92d90b
Opcode Fuzzy Hash: cff3c911b6417ffb54100031f902ace47520fc0173b042ebdcf8bd83f878b67d
Instruction Fuzzy Hash: 3E418370E1030ADFDB64DF69D44469EBBB6BF85740F208429E806EB340DB71E946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C7DEAD Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5606739ace60bd6d244fb96b1b10a056e510f465b7d2ba6ee0e99d54dc9e831
Instruction ID: f4055d8da60904c79164101e5239c36726872d1862b2f96ec894866208b024f1
Opcode Fuzzy Hash: b5606739ace60bd6d244fb96b1b10a056e510f465b7d2ba6ee0e99d54dc9e831
Instruction Fuzzy Hash: EA41B470E10746DFDB65DF79D88469EBBB2BF85300F248529E806EB240DB71E946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C721C5 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d237a4f2a44f82a3d0c3ff3e36473ad2e9df5e0ab714c098d29c841bd0d192
Instruction ID: ccfc69a3ca796e2a2a9173732f44105453dc0074b72d1a05f8ae5dbf1103d590
Opcode Fuzzy Hash: 65d237a4f2a44f82a3d0c3ff3e36473ad2e9df5e0ab714c098d29c841bd0d192
Instruction Fuzzy Hash: 6631DE30B003028FDB699B74D45866E3BA6BF89610F24856CD806EB381DF39CE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06C721D8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea11a67a29c97e9408a417382c0d44ca3b81840763e0a9bc59ae6e0c74c9c4b2
Instruction ID: da229d6a09a3ab99a372e5b2dd9a7ee1b9b9411a779bd8fb75226e9eda1cc5b5
Opcode Fuzzy Hash: ea11a67a29c97e9408a417382c0d44ca3b81840763e0a9bc59ae6e0c74c9c4b2
Instruction Fuzzy Hash: 0731A230B002068FDB599B75D45866E7BE6BF89610F24856CD806DB384DF39CE46CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06C7DD60 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c26804375b30bfd061b5a23d76bd50abe9afb2186df723926d808e3fa92a469
Instruction ID: bf09d1c6f24c2d878e67c07588733e576de1a6e2c7068b5dea112da2fd2e3978
Opcode Fuzzy Hash: 9c26804375b30bfd061b5a23d76bd50abe9afb2186df723926d808e3fa92a469
Instruction Fuzzy Hash: 7D31C830E1071A9FDF25DF69D88069EBBB1FF85304F144929D805E7244DBB1B946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06C72089 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041f09c8cfd5b765e70032cf018ed524374c85ccb94cbcc50b83798dca96dfff
Instruction ID: 423fc8ff7fcf1cebe5ab6d5eb15244dbc6efc84967a4796c51e257c41ce999e5
Opcode Fuzzy Hash: 041f09c8cfd5b765e70032cf018ed524374c85ccb94cbcc50b83798dca96dfff
Instruction Fuzzy Hash: 7B313C30E106059BDB54CF65C894AAEB7B2BF89300F108529E806EB751EBB5ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06C72098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44df2368095a78ca1692de0eed3ed7554f3eabca5bd9c1def3c567d55b02cecc
Instruction ID: 9c33f78b2ae84aa36b37ec28e013a8287217e63323dcab1b238e91a755cdea80
Opcode Fuzzy Hash: 44df2368095a78ca1692de0eed3ed7554f3eabca5bd9c1def3c567d55b02cecc
Instruction Fuzzy Hash: BB316230E106199FDB54CF65D85469EB7B6FF89300F108929E816E7350EBB5ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06C73EA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff7f86d1ee64ccdc1de8cb22a97e41a58966ccc6365c1c46febf9f946a7cbb9
Instruction ID: 81f215b005e315c6db020cc8843939f6fd1fc5112074f265b2ca008474d1dde4
Opcode Fuzzy Hash: 7ff7f86d1ee64ccdc1de8cb22a97e41a58966ccc6365c1c46febf9f946a7cbb9
Instruction Fuzzy Hash: 3A215E75F01216DFDB50CFAAD880AAEBBF1EB88750F108069E949E7341E735DD419B90

Uniqueness

Uniqueness Score: -1.00%

Function 06C73EB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a85ef3bd7d2592b6631197bb0a2e92106735f6c8f83ffb75f20fa18e48b11c7
Instruction ID: 5be109fb768b2f47aa11e6644f24f7376182e78ebb188d85cccdfeb40a22a1f4
Opcode Fuzzy Hash: 6a85ef3bd7d2592b6631197bb0a2e92106735f6c8f83ffb75f20fa18e48b11c7
Instruction Fuzzy Hash: 3C213975F0021ADFDB50CF6AD880AAEBBF5FB88650F108169E909E7340E735DD418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0137D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1653521391.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_137d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b998462b6fb15af3c7d3825e9663eaa4aac4d19b6db14be29a85f22360d46986
Instruction ID: 6599454b1549e40c6f74fa14e1ff99219acfae86e89d8aec72efc4d6f7e12479
Opcode Fuzzy Hash: b998462b6fb15af3c7d3825e9663eaa4aac4d19b6db14be29a85f22360d46986
Instruction Fuzzy Hash: 8B212571604304DFDB22DF64D8C4B16BB65FF84318F20C56DE8490B342C73AD446CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06C76CF8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd80385dad5ed94dea645e223d19e30bbc5eb8329c3ff1d78ab8dd3b8cffd50
Instruction ID: f0e4133c8a92e6dde0c367662defa9035f6f69084602fa85bf1390b906ff7ade
Opcode Fuzzy Hash: bfd80385dad5ed94dea645e223d19e30bbc5eb8329c3ff1d78ab8dd3b8cffd50
Instruction Fuzzy Hash: B821F330F111099FDF94DB6AE9546AEBBB6EB84310F248429E805E7380DB36DD418B84

Uniqueness

Uniqueness Score: -1.00%

Function 06C76D08 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8159f0cd6eeaa4c79ffc0e1bc811a1e4d6806651a9bf2c5b446094cf0e1ac422
Instruction ID: 8b4795a243056fae554fd9f1ebf2a32a796d4e20bb4ec6eee7eb20d2733fefd7
Opcode Fuzzy Hash: 8159f0cd6eeaa4c79ffc0e1bc811a1e4d6806651a9bf2c5b446094cf0e1ac422
Instruction Fuzzy Hash: 8B21E130F101199FCF94DB6AE9506AEBBB6EF84310F208429D805EB380DB36ED518B84

Uniqueness

Uniqueness Score: -1.00%

Function 06C7A2F8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f825160dc0c9463be1f58f11b8579bf35a0ec4fa036e43e67a90bbf546bc74b
Instruction ID: 9f49bdee87b3f00bd53c2de8ad54c252dd8c627d6241a35e5ecc4eda55f678f2
Opcode Fuzzy Hash: 8f825160dc0c9463be1f58f11b8579bf35a0ec4fa036e43e67a90bbf546bc74b
Instruction Fuzzy Hash: 3D11D636F101154FDBA0DABCE8907AFB7A1EB85720F10893DE10ED7355DA66DD428780

Uniqueness

Uniqueness Score: -1.00%

Function 06C73FC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cc475a4738d57ccc403255f3f8ec80f15b0285307121b85a9801c5f92316e0
Instruction ID: 00f70bd2f60b3d51098cf2194086d56c9670c7b78e649ee0867d0418e22d0324
Opcode Fuzzy Hash: c3cc475a4738d57ccc403255f3f8ec80f15b0285307121b85a9801c5f92316e0
Instruction Fuzzy Hash: 59116135B101298FDF99DA79D8146AE7BEAEBC8250F048539D40AE7340EF65DD028BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06C7F181 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d21d8701f2a11e4e9c5b82d04e040744e89b0269c68f82bc0c96839e079ea1
Instruction ID: b86b2a054011146ba2af9eac54859c335ad6d36bcc6916a675f330cc9cbe845a
Opcode Fuzzy Hash: d4d21d8701f2a11e4e9c5b82d04e040744e89b0269c68f82bc0c96839e079ea1
Instruction Fuzzy Hash: 81019772B101000FDB61863C988473FABDADBC7610F00887EF40ACB381ED28CE028380

Uniqueness

Uniqueness Score: -1.00%

Function 06C741F7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11440132669b871393007493c0a452f5ba63e90b7736ba0d0ca9cbd7633c6637
Instruction ID: 81c918f9120b7b7729755ba79ba2c3e2e0148d8484accaa1a795d1e6fb90d9a8
Opcode Fuzzy Hash: 11440132669b871393007493c0a452f5ba63e90b7736ba0d0ca9cbd7633c6637
Instruction Fuzzy Hash: 79018435B101104BEB6896ADD45876BA7DBDBC9611F24C43DE10EC7384E9A5DD264381

Uniqueness

Uniqueness Score: -1.00%

Function 0137D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1653521391.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_137d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 74bdc83109ebb5ce82fa4c07b9310683bb7e8fe5438384d784bdff0bbdc3e2ac
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: C611BB75504284CFCB22CF54D9C4B15BFA2FB84328F28C6A9D8494B292C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 06C73460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b83b94b4ff862cdf122d4ac2c40028de3dac28ba6fb126e331b58108d85145
Instruction ID: 89eb506090e77c1d11fd56e5806dbc1624f99dc5dc27f69d8c7104bba284bb66
Opcode Fuzzy Hash: c1b83b94b4ff862cdf122d4ac2c40028de3dac28ba6fb126e331b58108d85145
Instruction Fuzzy Hash: D401A171E002698BCB59DB79C8405DEFBB6EB88310F0085A9D40AE7341EA319A40DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06C73C80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab4c5419ccae3930f6b696b37037b62f3eea759c9c1a79f62884c0f441ea46d
Instruction ID: 0fe53386b43f474cd33f63b0dfa45eab8944ee896a20e8dfc8fab813882d2f7a
Opcode Fuzzy Hash: eab4c5419ccae3930f6b696b37037b62f3eea759c9c1a79f62884c0f441ea46d
Instruction Fuzzy Hash: 7811D3B5D01259AFCB00DF9AD884ACEFFB4FB48710F10812AE918A7240C374A654CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C74208 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d9ffdbfa77aafc2b7cc66c3a1544fbad308b36dc56664489da5bf64199653d
Instruction ID: e9d2f233566ac12870f732c992af8b318c7aeb4063e24adfe3d267facd637fee
Opcode Fuzzy Hash: 79d9ffdbfa77aafc2b7cc66c3a1544fbad308b36dc56664489da5bf64199653d
Instruction Fuzzy Hash: 8D016D35B100205BEBA89AAED45976BB3DADBCA610F20C43DE50EC7384DDA6DD164391

Uniqueness

Uniqueness Score: -1.00%

Function 06C73C7A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408b865eda26c544c78262b7a84e8561316493b46dca7235dd71da58e6b34aca
Instruction ID: d716032a9616a054ad33aaf4214da43aa48e0ed760dbaa8f0eeb421a66d84663
Opcode Fuzzy Hash: 408b865eda26c544c78262b7a84e8561316493b46dca7235dd71da58e6b34aca
Instruction Fuzzy Hash: 3F11D3B6D012599FCB00DF9AD985BDEFBB4BB48710F10811AE518B7240D374AA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C73FAF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718eed1871b33fba5be5d23f8e461b77b5fb54c9464a322978f038ae99829267
Instruction ID: 5bf9097b728f937fb955e1bf7666ceb01e0207c6772d1f31ca8883bffe2510e4
Opcode Fuzzy Hash: 718eed1871b33fba5be5d23f8e461b77b5fb54c9464a322978f038ae99829267
Instruction Fuzzy Hash: CE01DF36B100194BDB95CA68D8106AF76AB9BC8250F04443ED40AE7280EE60CD0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06C7F190 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322d0036ec8e31d8a1f79da6395fc1979656cdf42dd5cccbe3bd7699db80b62c
Instruction ID: 6fd7b98bc0497c581a525df999e59b1cba017e354995684d48c12efbff430a0d
Opcode Fuzzy Hash: 322d0036ec8e31d8a1f79da6395fc1979656cdf42dd5cccbe3bd7699db80b62c
Instruction Fuzzy Hash: 8D018176B105154BDB64956C989472FB7DAE7C9610F10883EF51BC7380EE65DD024385

Uniqueness

Uniqueness Score: -1.00%

Function 06C7A308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcec9266a83e25d0a67a162b280ca5610cbc2972de878674f4309b5a126f7ba5
Instruction ID: 6d22b8ef2805a203eefff73bd3d1d3c03ae2aa0765edca06736d58589dc10877
Opcode Fuzzy Hash: bcec9266a83e25d0a67a162b280ca5610cbc2972de878674f4309b5a126f7ba5
Instruction Fuzzy Hash: C9018C31B101144FDBA49ABDE46072FB3D6EB8A750F10883DE40EC7344EE66ED428780

Uniqueness

Uniqueness Score: -1.00%

Function 06C7CBD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44403826bd07f167dcdc86730b204e7acddecc568f1882f109b2e8a57f0a0b45
Instruction ID: 4781ee0558dcab97a85ecc85a49014448fbf0ef444c5265c1d572fbf8c8f77f2
Opcode Fuzzy Hash: 44403826bd07f167dcdc86730b204e7acddecc568f1882f109b2e8a57f0a0b45
Instruction Fuzzy Hash: 51012831F20225AFCF68AA6EE840A9EB779F785350F00443DE801E7344DB76AD0087C4

Uniqueness

Uniqueness Score: -1.00%

Function 06C782B7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc293400675d56278cccd15ba98719f11f9888b766a0cf6c5bded2fb57b68fc
Instruction ID: 4d30a2c5917f1b4a7b1d43a9cc07d9b38693e649fa3bc66f1e29c83d09d650cf
Opcode Fuzzy Hash: 7cc293400675d56278cccd15ba98719f11f9888b766a0cf6c5bded2fb57b68fc
Instruction Fuzzy Hash: FAF0A036E02114DFDF68CE5AE98C6AD77B1FB40312F1880BADA01E7150D3359E82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06C74A51 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc87255b339ebc169cc85a3314a0905d61d8153156caf4329fde04f995c45c0
Instruction ID: c9249a725711d3c47bbbe77325195d9fa1542a9edbaefb70354e6d994329fa44
Opcode Fuzzy Hash: fbc87255b339ebc169cc85a3314a0905d61d8153156caf4329fde04f995c45c0
Instruction Fuzzy Hash: 6BF0F470A20219DFDB18DF94D8697ADBBB1FF44710F204129E402A7284CB701C05CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 06C76460 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f003b22fc4c28e72e6567768d94fcff33b3f1f0f2152080f5ff1653225a9b65
Instruction ID: 8e65d863af151b7da120cf221c579c9f9c77f313abbf70b311e009910a5a26ce
Opcode Fuzzy Hash: 6f003b22fc4c28e72e6567768d94fcff33b3f1f0f2152080f5ff1653225a9b65
Instruction Fuzzy Hash: B5E0DFB2E106049BEB50CFB18A6834BB7AAEB45304F3148AED008EB311E136DF069701

Uniqueness

Uniqueness Score: -1.00%

Function 06C76470 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1684021021.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6c70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b996b5257d912014684181d89fd3465bbdc9df6c08fb94f59a6fdd0633af75f
Instruction ID: dd15101d607979089d467fd13db28f7be6ee54d9f5c58e50469cb710bf4aa431
Opcode Fuzzy Hash: 5b996b5257d912014684181d89fd3465bbdc9df6c08fb94f59a6fdd0633af75f
Instruction Fuzzy Hash: 76E0C270E10209ABDFA0CEB2C95575EB7ADD701304F2088A9D409CB201E136DB016780

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 5704, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	72
Total number of Limit Nodes:	4

Executed Functions

Function 00FBC7B0 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FBC83E
GetCurrentThread.KERNEL32 ref: 00FBC87B
GetCurrentProcess.KERNEL32 ref: 00FBC8B8
GetCurrentThreadId.KERNEL32 ref: 00FBC911

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 27c9f03d2d729616f47317359aedcac1c1f029ecdedef521beace37b04b6d740
Instruction ID: 246591db75074a05c698554a98d9cffcce95e8c5691f1402de46ce3c04066da4
Opcode Fuzzy Hash: 27c9f03d2d729616f47317359aedcac1c1f029ecdedef521beace37b04b6d740
Instruction Fuzzy Hash: CF5165B0D003498FEB14DFAAD548B9EBBF1AF88314F20845DE419A7391DB749944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00FBC7C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FBC83E
GetCurrentThread.KERNEL32 ref: 00FBC87B
GetCurrentProcess.KERNEL32 ref: 00FBC8B8
GetCurrentThreadId.KERNEL32 ref: 00FBC911

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 22526bd122336db8bbe2de540b0d9bb7a6d411f4379b7403f3776042fa3e3373
Instruction ID: 8479a6a586e7b3be2a2a19847c1ab7e467cbde7f0afec8bcc81eebd2052b8557
Opcode Fuzzy Hash: 22526bd122336db8bbe2de540b0d9bb7a6d411f4379b7403f3776042fa3e3373
Instruction Fuzzy Hash: BD5144B0D007498FEB14DFAAD548BDEBBF1AB88314F20845DE409A7391DB749944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00FBCE09 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FBCE97

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f867a1c649a2362d46ae907191152f975ba6bc4209ff0eb54e6a9395b52dc83f
Instruction ID: 29250ad550b6bccb5af5fd0cce9506d40180466f97d9a1c77799493ed0ee2073
Opcode Fuzzy Hash: f867a1c649a2362d46ae907191152f975ba6bc4209ff0eb54e6a9395b52dc83f
Instruction Fuzzy Hash: 7521E5B5900249DFDB10CFAAD484ADEBFF5FB48310F14841AE958A7251D375A951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FBCE10 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FBCE97

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f8e5f13883ab56e3f89fe8957f457f26a62344a992d5d35f79641bdd03cad3fa
Instruction ID: bf6f19db30e653b7d6082791e1f3a9ab2b9a3f0214732de5aafb48d5e779c5c3
Opcode Fuzzy Hash: f8e5f13883ab56e3f89fe8957f457f26a62344a992d5d35f79641bdd03cad3fa
Instruction Fuzzy Hash: C621C4B5900249DFDB10CFAAD884ADEBBF9FB48320F14841AE958A3350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00FB98B0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00FBA7F9,00000800,00000000,00000000), ref: 00FBAA0A

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e013d20602cee459c40829971199accc730d2c3d665ffc6d5de335bf78c3eb94
Instruction ID: caa7672574450df6a7c13266259ca2720b9399671095e542dec451b562acc05f
Opcode Fuzzy Hash: e013d20602cee459c40829971199accc730d2c3d665ffc6d5de335bf78c3eb94
Instruction Fuzzy Hash: 0E1106B68003099FDB10DF9AC444BDEFBF4EB88310F14842ED519A7200C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00FBA718 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FBA77E

Memory Dump Source

Source File: 0000000E.00000002.1658903640.0000000000FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fb0000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bbb31e22354113cc25a112d02592e660ae325503f341d8f94072f920f806a605
Instruction ID: 53689d23ee79b3af802488a78477de91db017480464439f31bee578ac5f2ac4f
Opcode Fuzzy Hash: bbb31e22354113cc25a112d02592e660ae325503f341d8f94072f920f806a605
Instruction Fuzzy Hash: 5A1110B6C003498FCB20CF9AC844BDEFBF5EB88320F20841AD419A7210C779A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1657124560.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f5d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18626c363318a2d8026f09c801da620481571c854184fca774f651b419237b8
Instruction ID: 01e9c487fb687281b2033623d01c94a3dd740b0793d87aa8cafa3c4661bc9e5c
Opcode Fuzzy Hash: e18626c363318a2d8026f09c801da620481571c854184fca774f651b419237b8
Instruction Fuzzy Hash: 31214872905304DFDB25DF04D8C0B26BF61FB94325F24C169DE090B256C336D84AEBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1657468842.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f6d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41d13227e756b1baf66513c4786252c9b71b709bab1c8a15f8d0751a73d0ee8
Instruction ID: bade58bdc990676ed8d6638a724c9325f00da6709ccc1d200dca93359d4e8b06
Opcode Fuzzy Hash: c41d13227e756b1baf66513c4786252c9b71b709bab1c8a15f8d0751a73d0ee8
Instruction Fuzzy Hash: 9F21D375A04344EFDB14DF14D984B16BB65FB84324F24C569D84A4B28AC336D847DA62

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1657468842.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f6d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d3dd5ad65e4e0d075798911d85ea3a8d6ebc575737569c379d8af10a4772ac
Instruction ID: 9c8ad7385b28465fca3f2e703314e5aedc83d4708bc3a67007bb798bc38b0896
Opcode Fuzzy Hash: 75d3dd5ad65e4e0d075798911d85ea3a8d6ebc575737569c379d8af10a4772ac
Instruction Fuzzy Hash: 882165759093C09FC712CF24D594715BF71EB46324F28C5EAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F5D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1657124560.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f5d000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 679b9c1ea29264eb31ad43bf5d4e2c99ae479a3f49b9aa835e9fdc1d9d90d367
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: A1110376904244CFCB16CF04D5C0B16BF72FB84324F28C1A9DD090B656C33AD85ADBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbsBVT.exePID: 3040, Parent PID: 5704COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	9

Executed Functions

Function 06D7B21F Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e67ec72014a3a9c39a4106ea86719b162e8da5b35b07893cddb2173a43a9d2
Instruction ID: a4799f1d35d05e5b46790458f2a5f08182d700d16cb6fdba2b7eadcc6c044ec6
Opcode Fuzzy Hash: e8e67ec72014a3a9c39a4106ea86719b162e8da5b35b07893cddb2173a43a9d2
Instruction Fuzzy Hash: F4225030E112098FEF64DF58D4907ADB7B2EB89310F64842AE455DB391EB35DC81DB92

Uniqueness

Uniqueness Score: -1.00%

Function 06D73460 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b0a9b6bf2f571a19aa185d47a5f9455575d9472427d9eb839082030e183426
Instruction ID: 29acf189ee5929cb7127805f8303f64aad7aa4444a58bb7f5ad3840d5f527036
Opcode Fuzzy Hash: 06b0a9b6bf2f571a19aa185d47a5f9455575d9472427d9eb839082030e183426
Instruction Fuzzy Hash: E3323D31E1071ACFDB14EB75C89069DB7B2FFC9300F61C6AAD409A7214EB30A985DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D53200 Relevance: 6.1, APIs: 4, Instructions: 137
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06D5328E
GetCurrentThread.KERNEL32 ref: 06D532CB
GetCurrentProcess.KERNEL32 ref: 06D53308
GetCurrentThreadId.KERNEL32 ref: 06D53361

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d7ee51fc564f17229d994d94cc13e1650f6eb512cc215f74a647c97434a8bf34
Instruction ID: caba7812002702f267937309eb3d2c1f928c24d5ef09eba3c717bc468ccb58cb
Opcode Fuzzy Hash: d7ee51fc564f17229d994d94cc13e1650f6eb512cc215f74a647c97434a8bf34
Instruction Fuzzy Hash: E25144B0900349CFDB54DFAAD988B9EBBF1FB88314F258059E409A7350DB34A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06D53210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06D5328E
GetCurrentThread.KERNEL32 ref: 06D532CB
GetCurrentProcess.KERNEL32 ref: 06D53308
GetCurrentThreadId.KERNEL32 ref: 06D53361

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dc1ee991535f748fb387063d6e0be2d084970a04bd7eb453418328e9f7823eaa
Instruction ID: fcf4d2aafef9a1852814e6fd2d1c1aa2ee96d68ee632cb2887ae780886154940
Opcode Fuzzy Hash: dc1ee991535f748fb387063d6e0be2d084970a04bd7eb453418328e9f7823eaa
Instruction Fuzzy Hash: 4F5144B09007098FDB54DFAAD948B9EBBF2FB88314F258059E409A7350DB74A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06D5B718 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D5B97E

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 98ea49f0d430e6e122b6e3801caa0aa2dbaaaea8ba2fc7b0ad90ae22ccd8a6ff
Instruction ID: 3ba990f83b2288d6a40dcd65e26cdf0744595b75f9d96592eac2ac325602cf71
Opcode Fuzzy Hash: 98ea49f0d430e6e122b6e3801caa0aa2dbaaaea8ba2fc7b0ad90ae22ccd8a6ff
Instruction Fuzzy Hash: 81816770A00B058FDBA4DF2AD45176ABBF1FF88200F11892ED88AD7B50DB75E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D5D8B0 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D5DA22

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 98adf1fa8eb4d625be3248ce73eaa93f369f71b5b0b1eea7db273bb8efba64ed
Instruction ID: 5bf42a52db193cf1946d94bbc6f66dbe064ca0210aba93d3d1c0650dc0b081b0
Opcode Fuzzy Hash: 98adf1fa8eb4d625be3248ce73eaa93f369f71b5b0b1eea7db273bb8efba64ed
Instruction Fuzzy Hash: B451F0B1C00249AFDF15CFA9C880ADDBFB6FF49310F25816AE818AB221D7759955CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06D5A884 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D5DA22

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 52ee72760f1df17355fb65b334e90816362bc96cc4697d94be2c7aff48385ce5
Instruction ID: 2a58728e1ff2213be12a781049fecfb78f33dbaf2643a5bebfc82cf851b9c823
Opcode Fuzzy Hash: 52ee72760f1df17355fb65b334e90816362bc96cc4697d94be2c7aff48385ce5
Instruction Fuzzy Hash: A851AEB1D00309DFDF14CF9AC884ADEBBB6BF48710F25812AE819AB210D775A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 06D53518 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d3bd1e2a0b0137da88b59adeb3c761aefbd16b93a2d175885df21fd57ef3a4
Instruction ID: cb791164ea21c757765292b400307800f4f4b23bc9fd425784745d6399c1e273
Opcode Fuzzy Hash: 08d3bd1e2a0b0137da88b59adeb3c761aefbd16b93a2d175885df21fd57ef3a4
Instruction Fuzzy Hash: 9041A075A503849FE700EF60F4A576A3FA6FB94310F15806AFA02DB3D6DBB40845CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06D758B0 Relevance: 1.6, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06D7590E

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a7b7655649aa07bf3001891212d2c4e2d0718b9174517a21fadc4d19f11e826d
Instruction ID: 1aaf29e298edbd2cd0e5a7f2685aa470fa1ce4ca63aec493f9c07db8ed1f873c
Opcode Fuzzy Hash: a7b7655649aa07bf3001891212d2c4e2d0718b9174517a21fadc4d19f11e826d
Instruction Fuzzy Hash: B4C17D75F00219CFDF54DBA4D4506AEB7B6EF88311F208569D902AB354EF31AD42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 06D52EF4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06D5341E,?,?,?,?,?), ref: 06D534DF

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3a3914a1ffe910670556eb799e8385ad49e0e2a88de69f06614716f4688077a2
Instruction ID: afed3d66c920cbaefd40fc4c2237716c5ea8e550f2df2674b98cd8775ed83219
Opcode Fuzzy Hash: 3a3914a1ffe910670556eb799e8385ad49e0e2a88de69f06614716f4688077a2
Instruction Fuzzy Hash: 5E2116B5D003499FDB10CFAAD884ADEBBF4FB48310F15801AE914A7310D379A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06D53450 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06D5341E,?,?,?,?,?), ref: 06D534DF

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 96542908715f59d45ce7c354c8c15eff7dd2cabac785bbc248ec51d83a61d155
Instruction ID: 25af7e1d6bb23a90dc290160ff66bea41438c2c2902086e1fb21526624f1e076
Opcode Fuzzy Hash: 96542908715f59d45ce7c354c8c15eff7dd2cabac785bbc248ec51d83a61d155
Instruction Fuzzy Hash: C921D2B5D003499FDB10CFAAD884ADEBBF9EB48310F15841AE918A3350D379A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D5BB7B Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06D5B9F9,00000800,00000000,00000000), ref: 06D5BBEA

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 09ca797594bfd378357e8c5325e388000a0e540df617b1ba041427dd253fbe82
Instruction ID: 144f784650293ac641d67e0d56b923c30e758004240456003372f2fd7e9354d0
Opcode Fuzzy Hash: 09ca797594bfd378357e8c5325e388000a0e540df617b1ba041427dd253fbe82
Instruction Fuzzy Hash: 911114B6C003098FDB10DF9AD844AEEFBF4EB88710F11841ED819A7600C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D5A710 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06D5B9F9,00000800,00000000,00000000), ref: 06D5BBEA

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 06c5f51ce51d3109cea1b78ad0c6d90777b63237b0d6d4434b860a8ca2bda327
Instruction ID: 2f8cdb15aa2cc9816d8e5dad4a3e724c0cc0b7e162aec3238ef235692a9447c1
Opcode Fuzzy Hash: 06c5f51ce51d3109cea1b78ad0c6d90777b63237b0d6d4434b860a8ca2bda327
Instruction Fuzzy Hash: C31117B6C003098FDB10DF9AC884BAEFBF4EB48710F11841ED959A7600C7B5A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D6F023 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02D6F08F

Memory Dump Source

Source File: 00000013.00000002.2638807041.0000000002D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2d60000_cbsBVT.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9b45aa5cda8356165a97e3239ecce95f75589f4a8834a55d6d8e589fac5a9dbc
Instruction ID: daca52b0b37d03df5168c3dedc8bb519aa13b22e429eafbdbc2175389db626af
Opcode Fuzzy Hash: 9b45aa5cda8356165a97e3239ecce95f75589f4a8834a55d6d8e589fac5a9dbc
Instruction Fuzzy Hash: 121103B1D0065A9FDB10DFAAC844B9EFBF4AB48620F11812AD818A7341D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D6F028 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02D6F08F

Memory Dump Source

Source File: 00000013.00000002.2638807041.0000000002D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2d60000_cbsBVT.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 397a1af7ddfad79a4c5572473f64e141d1f36a14c2e4a56ab9b7509ae1093f50
Instruction ID: 87c6a1c7d89cbbcad72bea62dad09450ca1d6c9881be0b123a329111320f8e96
Opcode Fuzzy Hash: 397a1af7ddfad79a4c5572473f64e141d1f36a14c2e4a56ab9b7509ae1093f50
Instruction Fuzzy Hash: E51114B1C0065A9FDB10DF9AC44479EFBF4BF48720F11812AD818A7341D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D5B918 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D5B97E

Memory Dump Source

Source File: 00000013.00000002.2668893809.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d50000_cbsBVT.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 738155e8106b3638168e1b8a6bc495e089e4d9781451d78f68a945fb6f3920a2
Instruction ID: 54fcd7bb231ba82f7f91c47ad1462a9c82f07a89ea3c9d4f67052e2a5a2f3d17
Opcode Fuzzy Hash: 738155e8106b3638168e1b8a6bc495e089e4d9781451d78f68a945fb6f3920a2
Instruction Fuzzy Hash: 3C11E0B6C007498FDB20DF9AC844BDEFBF5EB88624F11841AD869A7710C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07122400 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0712333D

Memory Dump Source

Source File: 00000013.00000002.2670527438.0000000007120000.00000040.00000800.00020000.00000000.sdmp, Offset: 07120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7120000_cbsBVT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 86e0be0d8c229430a5cf6b971024282a0c29f1d25f99e8aadb2868dd3fdf10c2
Instruction ID: 23440545e2167172725eb2e22909b05761650e0a45611275bf1d6673344ce748
Opcode Fuzzy Hash: 86e0be0d8c229430a5cf6b971024282a0c29f1d25f99e8aadb2868dd3fdf10c2
Instruction Fuzzy Hash: A41115B58043598FCB20DF9AD444B9EBBF4EB48620F108419D569A7340C779A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 071232E0 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0712333D

Memory Dump Source

Source File: 00000013.00000002.2670527438.0000000007120000.00000040.00000800.00020000.00000000.sdmp, Offset: 07120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7120000_cbsBVT.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3e954da41dcb6185710d80952f80b867a657c416c5f06fab857df14b200d4f4e
Instruction ID: 189e7e90e922bd948f3d02758ef8c0708c91fe493e14d2f8ac6a719e3693d5a2
Opcode Fuzzy Hash: 3e954da41dcb6185710d80952f80b867a657c416c5f06fab857df14b200d4f4e
Instruction Fuzzy Hash: 491135B58003598FDB20DFAAD844BDEFBF4EB48324F20841AD519A7340C778A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D758AB Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

$, xrefs: 06D7590E

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: f099815f86b14fb8efe8430995606b424fd7556ee60b5ae64116545eab76456f
Instruction ID: 3086577304f9334581135ef8693b93e4014cff7447eb2a78ec22a80c110e222b
Opcode Fuzzy Hash: f099815f86b14fb8efe8430995606b424fd7556ee60b5ae64116545eab76456f
Instruction Fuzzy Hash: 6E914875E002199FDF54DBA4D550ADEBBF6EF88320F208569D801BB354EB32AD42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06D7D338 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1378c3b163adf18051e87791f52877e5172ba74b21001538dcc2e9fad15254
Instruction ID: 7565cfd53567491dd099988df00200e845842b480e06dbc2f6c2b72d342a5019
Opcode Fuzzy Hash: fa1378c3b163adf18051e87791f52877e5172ba74b21001538dcc2e9fad15254
Instruction Fuzzy Hash: 26621C30A003198FDB55EB68E590A5EB7F3FF84710B218A68D4059B359EB71ED46CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 06D7ACC8 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2f73ec70077e72ac84a669c29c8c4d0fa08fff51525e121607c2c6f7f4333e
Instruction ID: d561287583e8ebe0b4125417748d8974fcbddd27ca38b65c0604369a5b1f35a6
Opcode Fuzzy Hash: 5b2f73ec70077e72ac84a669c29c8c4d0fa08fff51525e121607c2c6f7f4333e
Instruction Fuzzy Hash: 35E15B30F1021A9FDB64DF68D4506AEB7B2FF89311F24852AD806DB354EB719846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 06D7B638 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50a894edd6f8e9a0973e772c86edd9f19d5def0cd6d1bd577ee85a03ea03579
Instruction ID: dd4938726ef95e94023594fb8ccd4962473886f347ec768ea390893316280dfc
Opcode Fuzzy Hash: d50a894edd6f8e9a0973e772c86edd9f19d5def0cd6d1bd577ee85a03ea03579
Instruction Fuzzy Hash: 72B12830E002098FEBA0DF68D494BADB7B2EB45310F64896BE455DB351EB34DD85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 06D76D08 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d091a0bdae8c6cff1339ffc6c5572e3405b13af4ffcd323d7a5002131870af88
Instruction ID: 60cdedc254b6e56f53c7cb1df66fa529cb2f1d8950208858db4507e8e109b6e7
Opcode Fuzzy Hash: d091a0bdae8c6cff1339ffc6c5572e3405b13af4ffcd323d7a5002131870af88
Instruction Fuzzy Hash: 96A17A30B00614CFDB54EB68D554B6DB7F2EF84310F648869D40AAB390EB36EC45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 06D78068 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb08606cc886182fba1cad0e007f3d828cd5333dfb8b1314cb87fff2dac89d8
Instruction ID: 59cfa3132d39ae1a6029008f12c8550527406310672641563086298913fca9d8
Opcode Fuzzy Hash: 7bb08606cc886182fba1cad0e007f3d828cd5333dfb8b1314cb87fff2dac89d8
Instruction Fuzzy Hash: 87817E30B006158FDB68EB79D86466EB7A2FFC5311F108539D806DB394EB71E842DB92

Uniqueness

Uniqueness Score: -1.00%

Function 06D79140 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5214894fcbd0cf2927fb0ea329cbcc70fb64d5d22bf49251808546547e08e3b
Instruction ID: 6c63961c6983f16300e09e9ee825d06c125c796066365531fe3317acba005840
Opcode Fuzzy Hash: e5214894fcbd0cf2927fb0ea329cbcc70fb64d5d22bf49251808546547e08e3b
Instruction Fuzzy Hash: 80912F31F0061A8FDB94DB69D8607AEB7B6BFC9300F108569D809EB384EB319D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D761E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ffc16f7a4dad7762889ce1c2fb20e9508940b6d20cc7b65ae90c8253194260
Instruction ID: dff33f5e4693197894447476c53977acbc281377d2ba98622ee0dc5d23d899af
Opcode Fuzzy Hash: b0ffc16f7a4dad7762889ce1c2fb20e9508940b6d20cc7b65ae90c8253194260
Instruction Fuzzy Hash: 9761C771F005214BDF64AB7DC840A5EBADBEFC4610B154436D80ADB3A4EE65EC4287D6

Uniqueness

Uniqueness Score: -1.00%

Function 06D742A3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b53d1345ddf8edb89a2dbe87130d6cfe81137e10cc7244b005a7a049dad4fa
Instruction ID: a47a2ed8deaee14da90ed38f4c3a3a2c8c1969d5830da07d4adfdee99912f047
Opcode Fuzzy Hash: 86b53d1345ddf8edb89a2dbe87130d6cfe81137e10cc7244b005a7a049dad4fa
Instruction Fuzzy Hash: E8813030B0120A8FDB95DFA4D45076EBBF7AF89710F108529D80ADB384EB75DD428B92

Uniqueness

Uniqueness Score: -1.00%

Function 06D745BC Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d740eecd84b37ac6b1dea9c1a4d1661ee4db73e20272150dbcab8e1ae28d36
Instruction ID: a3d70e00036f84aae63d746fa354e5164b10559d71257962d451d24a29cfa074
Opcode Fuzzy Hash: d3d740eecd84b37ac6b1dea9c1a4d1661ee4db73e20272150dbcab8e1ae28d36
Instruction Fuzzy Hash: 87914C30E102198BDF60DF68C880BDDB7B1FF89310F208699D549BB245EB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06D74298 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb7fbb11326547284dd1bc7ad849064ee24cdf267420ee7d5bcb38196d9493a
Instruction ID: 057fc2f554fb97fba483c8133417ffc7f708fc4bd19a98bb6f09690f5d85c64b
Opcode Fuzzy Hash: 4eb7fbb11326547284dd1bc7ad849064ee24cdf267420ee7d5bcb38196d9493a
Instruction Fuzzy Hash: 27812E30B0120A8FDB95DFA4D45076EB7F7AF89710F208529D40ADB394EB75DD428B92

Uniqueness

Uniqueness Score: -1.00%

Function 06D745D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25f21917a87ea4a686e29666ce17560f813d77108387c100f623019bc83e4d0
Instruction ID: 8cc8799ae168de91f1f1b72dc3d7faf882f23df598fc45b60e942404afe6532a
Opcode Fuzzy Hash: c25f21917a87ea4a686e29666ce17560f813d77108387c100f623019bc83e4d0
Instruction Fuzzy Hash: D5912C30E106198BDF64DF68C880B9DB7B1FF89310F208699D549BB345EB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06D7EF00 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11033cca0a5e9c1dcdf6d263eacc608e31e55e570fe465d8ddc2fa8d48b1d288
Instruction ID: ffa80c576f3ca15987101f22124b00086a13fd9e576ab6b89152de3d52abcbba
Opcode Fuzzy Hash: 11033cca0a5e9c1dcdf6d263eacc608e31e55e570fe465d8ddc2fa8d48b1d288
Instruction Fuzzy Hash: 1F715A30A002499FDB54EBA9D890AAEFBF6FF84310F248469D455EB355EB30EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D7EF10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2ff5dad7651f1a75867371d81bbd7f016fe3cc45ab0696a65a0237c049d881
Instruction ID: c90644e690284242e3620de1b7f6b3feac0fd00a37ad2ecff5aa64239593ec34
Opcode Fuzzy Hash: 2a2ff5dad7651f1a75867371d81bbd7f016fe3cc45ab0696a65a0237c049d881
Instruction Fuzzy Hash: 83713A70A002498FDB54DBA9D990A9EBBF6FF84310F248469D405EB354EB30EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D74B68 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7e39735fd6e561eeff3bed2dd72a6d9aa02f02cd9c7b332dc64374c7732272
Instruction ID: 51d1aaac92f5582a48d49153f63ee73b7a84c1b5871af566d824e356e0855e69
Opcode Fuzzy Hash: 6d7e39735fd6e561eeff3bed2dd72a6d9aa02f02cd9c7b332dc64374c7732272
Instruction Fuzzy Hash: 13618C70F002189FEB559BA4D8147AEBBF6EF88310F20852AD506AB394DF758C458F95

Uniqueness

Uniqueness Score: -1.00%

Function 06D75598 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f215bf71c1431c304fe7da411f13847bd028b6170706915660e3135d05cb05
Instruction ID: 956a0c50f42bdee5d5827c31e165c2b4699105709f84114bf28246546c581759
Opcode Fuzzy Hash: 05f215bf71c1431c304fe7da411f13847bd028b6170706915660e3135d05cb05
Instruction Fuzzy Hash: DA510635E042458FEF718F68E4C077EBBB2EB45310F64886AD059DB292EA35D941CB93

Uniqueness

Uniqueness Score: -1.00%

Function 06D7FC69 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaa5d7d3abbc03261843085f74e5a76d96ea407d67c255ec61d3b3c30c0ec4f
Instruction ID: 4599f1537dad451021fcf40da36d30849d262cad67c489fc26852f2b62bb1e02
Opcode Fuzzy Hash: cbaa5d7d3abbc03261843085f74e5a76d96ea407d67c255ec61d3b3c30c0ec4f
Instruction Fuzzy Hash: 8751D031E00209DFDF64EBB8E4946ADB7B2EB84315F20886AD106DB250EB318955CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 06D7FA18 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1643c71d1c309d4358b4b603abfc338407a780e8589618dafd2fb3dae370b9d2
Instruction ID: 768a5d8246f143171c7ca5de41aac135766f7ffc644c03eab2bf98ee9850f303
Opcode Fuzzy Hash: 1643c71d1c309d4358b4b603abfc338407a780e8589618dafd2fb3dae370b9d2
Instruction Fuzzy Hash: F051A130B202098BEF746768D8A4B6F7A5AD7C9710F60442AE40AC7399DB69CC4197E3

Uniqueness

Uniqueness Score: -1.00%

Function 06D7913B Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30586d9d8e7e1eb3098d153ad2163ac69265f0fa61c1d2ccb899cb18caba25c
Instruction ID: e05a03e1ef0a80089ce8dc36ffebd0504e697783574f1bb121891b3117ee9fdb
Opcode Fuzzy Hash: c30586d9d8e7e1eb3098d153ad2163ac69265f0fa61c1d2ccb899cb18caba25c
Instruction Fuzzy Hash: AD512131B0151A9FDB94EB68D860B6EB7F6BFC9740F108469D80ADB384EA31DD058B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D7FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9a9b91aa9effdbe6b5aebed93f12a9655b046d6b995ad38fd88c4afb9abcec
Instruction ID: 6acd44f2ffa1cf901789c6026bbab1000b20f98869d8572452dfff72466bdd88
Opcode Fuzzy Hash: 6f9a9b91aa9effdbe6b5aebed93f12a9655b046d6b995ad38fd88c4afb9abcec
Instruction Fuzzy Hash: C0518F30B202088BEF746768E8A4B6F765AD7CD711F60442AE50AC7398DF69CC4197E3

Uniqueness

Uniqueness Score: -1.00%

Function 06D7CBD0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e13bbf2281d151c4583733f6134643a6a8b96a0c2312780d0af998d56cb7a17
Instruction ID: 4240763e273b385d4d64f1ceae31f3553a5632cb5050484f7bd5b6ead8039be7
Opcode Fuzzy Hash: 5e13bbf2281d151c4583733f6134643a6a8b96a0c2312780d0af998d56cb7a17
Instruction Fuzzy Hash: ED513031B103198FDB54EB78E450A9EB7F2FBC8311F218569D805AB359EB71EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D74B5B Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98a39471f79cd28cad502ef84528c34bfad36ea3678288a4095548bb53d60de
Instruction ID: 0b7ccfbcda1a62066cafa691e92741b823b6974641f242a5cc9895d862abb46d
Opcode Fuzzy Hash: d98a39471f79cd28cad502ef84528c34bfad36ea3678288a4095548bb53d60de
Instruction Fuzzy Hash: 69517D70F002089FEB599BA5C814BAEBBF7FFC8700F20852AD505AB395DE719C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D75411 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5666d90bde0fe653ef796b5bed3ac5a4848657111885846ff6dd302a683f47d
Instruction ID: 20edd09e674acdb8541b0811a49db27e1f28b31bf5b8fc5deb429f9f4071ddb1
Opcode Fuzzy Hash: e5666d90bde0fe653ef796b5bed3ac5a4848657111885846ff6dd302a683f47d
Instruction Fuzzy Hash: 4D419571E002099FDF70CFA9E881ABFF7B6EB88314F10492AE155D3550EB30E8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 06D7DEAD Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de34caab41ff0bc40499684959ef1458bf8557e8f3baf983a2f72a4e1dc32972
Instruction ID: 244c60742a4d34593c9473bcbdbb6ca19591b7181ec55bbd4dad2724c8a70d63
Opcode Fuzzy Hash: de34caab41ff0bc40499684959ef1458bf8557e8f3baf983a2f72a4e1dc32972
Instruction Fuzzy Hash: FB41A330E0024ADFDB55DF65D84569EFBB2BF85300F208529E806EB240EB71D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 06D721D8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb771354b5ea84e51dbaa1b774eaf667e6146b9f9d6cfe1919ee92504013dd1
Instruction ID: 864a63727af747da9d1907a3a957db10d8eec250c0106c04d60e01f7141e9690
Opcode Fuzzy Hash: 0bb771354b5ea84e51dbaa1b774eaf667e6146b9f9d6cfe1919ee92504013dd1
Instruction Fuzzy Hash: 49317E30B002898FDB59AB74D45466E7AB2BB89710F20856CC806EB344EF31CD018BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06D7DD60 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfec31a6d94221230fbd513869b594aff152484c11f96266e5b77e9f507a7fe
Instruction ID: 02cd7fc8f6f7493f432cc1b9b1bebcafa53662bc1b4e8feebe70812982334861
Opcode Fuzzy Hash: edfec31a6d94221230fbd513869b594aff152484c11f96266e5b77e9f507a7fe
Instruction Fuzzy Hash: C231A630E1071A9FDB15DF64D89069EFBB6FF85310F244929E805EB244EB71E846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 06D7208A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06af67f507c676ba95ffc5b5d13e9ef8cb93629117374cb3f25865d59b097bac
Instruction ID: 51f37391e60333274863e7b749f8f051709b5eedb7a0c5b7e25a44820fda087a
Opcode Fuzzy Hash: 06af67f507c676ba95ffc5b5d13e9ef8cb93629117374cb3f25865d59b097bac
Instruction Fuzzy Hash: 5231BE30E1025ADBCB58DFA4D85469EB7F2FF89310F608529E806EB340EB71AD42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06D72098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96917ed125e607d079781d8d5649af3fdd91d71ca84b29353263ddcfea2eab99
Instruction ID: d8ee3a5e9113e92d5fb183538bd8763d04457d0810cd6b4aa70e1e42f2fb02af
Opcode Fuzzy Hash: 96917ed125e607d079781d8d5649af3fdd91d71ca84b29353263ddcfea2eab99
Instruction Fuzzy Hash: E4317C30E1065ADBCB58DFA4D85469EB7F2FF89300F208529E906EB340EB71AD46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D73EA3 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3093a656364a04d9eff47bf350d99dc098fd7f73acb8b45dc3d362b418da3d
Instruction ID: 3baeae13eee5170f838cdc3f28dc3d8b838462e2e71ec139bd68b08ef7467f7a
Opcode Fuzzy Hash: 1a3093a656364a04d9eff47bf350d99dc098fd7f73acb8b45dc3d362b418da3d
Instruction Fuzzy Hash: AC21AE75F00619DFEB50DF69E850AAEBBF5EB88710F048025E905E7340EB31DC018B91

Uniqueness

Uniqueness Score: -1.00%

Function 06D73EB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0299b2f7c983ddcc765b30b9dce7388987688056f15f3bb2ebdefe8df402468e
Instruction ID: 8cc7cd94c8d4546a79174cb4063cde74b64e2617b92839ccb87aec8ced68835f
Opcode Fuzzy Hash: 0299b2f7c983ddcc765b30b9dce7388987688056f15f3bb2ebdefe8df402468e
Instruction Fuzzy Hash: 4F214875F00619DFEB50DFA9E890AAEBBF5EB88750F118029E905E7384E731DC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2638132516.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2cdd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b84e0d7328720cc072340cbd0c72bee5fb55cd3cb62e926f479a7d164888de
Instruction ID: d2bff013ea10a8ab1eac1ba25bfa7763d36014a9046e4491033b10a9c6ca3461
Opcode Fuzzy Hash: c0b84e0d7328720cc072340cbd0c72bee5fb55cd3cb62e926f479a7d164888de
Instruction Fuzzy Hash: BD212572A043049FDB10DF20D9C4B16BBA5FBC4314F20C56DEA4A0B242C736E446CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D76CFF Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f208e33d919f0ea867132abaab8767aa6bf71f676f04f0adca43b3e9fc791e
Instruction ID: cb574cca750ce9f2282162249c8d63fd6bdd8a3c28ecfb7c7ed24abe5644a7d4
Opcode Fuzzy Hash: 47f208e33d919f0ea867132abaab8767aa6bf71f676f04f0adca43b3e9fc791e
Instruction Fuzzy Hash: FA219030F111199FDF94EB69E8506AEBBB6EBC4310F248425E805EB385FB32DC418B85

Uniqueness

Uniqueness Score: -1.00%

Function 06D73453 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8068bf6af1c2696bdd09a68f3d29263692651c927184bb7fe04adf0218da082
Instruction ID: fbbf9cd218c52fdbe856b0151d9d41b4df9f7f1c2c0cbecf55945132e3faa98b
Opcode Fuzzy Hash: e8068bf6af1c2696bdd09a68f3d29263692651c927184bb7fe04adf0218da082
Instruction Fuzzy Hash: 9111C671E002299FCB59DB79C8415DEFBF5EF89310F05896AD546E7201EA31C940DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06D7F181 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9cf79969c81cc3e2612eee9b74cf31cb21a23c3f6c71e5ca219873dcc99e6a2
Instruction ID: 6abf55c76897486fe360b9a5b342d2d890849dd7aeb211e085c2772850baa6f2
Opcode Fuzzy Hash: c9cf79969c81cc3e2612eee9b74cf31cb21a23c3f6c71e5ca219873dcc99e6a2
Instruction Fuzzy Hash: 7201F576B101151FC771977CA890B2B77DADBC6610F21883AF90AC7341EA14CD068392

Uniqueness

Uniqueness Score: -1.00%

Function 06D73FC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6eaa98d29d8397b7802915a23a587cfc3356c59f186abcfd8fde00ecbbf00b6
Instruction ID: b816f3424f66e4455b36b77e297845d9b63922091ce98c19d1cd234e734658b6
Opcode Fuzzy Hash: e6eaa98d29d8397b7802915a23a587cfc3356c59f186abcfd8fde00ecbbf00b6
Instruction Fuzzy Hash: EE11AD35B001298FDF95DA69D8246AE77FAEBC8350B008439D90AE7340EE35DC028BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06D73C79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2c2f243cd05dd9766e968c8692baa4cdabe21a7f72c96da47d711eff5b46e1
Instruction ID: 8c89cbe7c6e4c95610a8d1603972173d0883764517acb1ad73e540c4c891661a
Opcode Fuzzy Hash: ea2c2f243cd05dd9766e968c8692baa4cdabe21a7f72c96da47d711eff5b46e1
Instruction Fuzzy Hash: 492103B1C01219AFDB10DF9AD884ADEFFB8FB48710F10812AE918A7340D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D74203 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbd61dd6d25b8400f8f21b84af1a8722a05d0968a2cb4be965fbfa6eb4732a7
Instruction ID: 79a2835cbaea6f1ef04e853b605bde4048ccdb602e365461c2d45038b42cea47
Opcode Fuzzy Hash: 8cbd61dd6d25b8400f8f21b84af1a8722a05d0968a2cb4be965fbfa6eb4732a7
Instruction Fuzzy Hash: 5301A231B100210BDBB59AADA42476FB3DBDBC6610F20843AE60EC7384EA65DC1643D2

Uniqueness

Uniqueness Score: -1.00%

Function 02CDD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2638132516.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2cdd000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: fa78a0be85fd9f87f603f82215a77ca77690a9619a34d905e22127acdf98e481
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 3D11D076904244CFCB11CF10C9C4B15BBB2FB84324F24C6AED94A4B252C33AE44ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 06D7A2FB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb325cc2ac6058706bc65cc6d38c03261aefbccb44552acee12629b9209ba94
Instruction ID: 25b73cddea99990dcad4946d056d9880509e5f206c20991b7027d8808c2ccf0f
Opcode Fuzzy Hash: dcb325cc2ac6058706bc65cc6d38c03261aefbccb44552acee12629b9209ba94
Instruction Fuzzy Hash: 4701BC30B046114FD761ABB8E86072F77E6EB86710F648469E10ACB395EE25EC028392

Uniqueness

Uniqueness Score: -1.00%

Function 06D73FB3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b7107fc35310d78eed3e98a50e4b64a6e60586d7792949686be8a88d2090bc
Instruction ID: 95a176e20ee8cdb0f7f72bccef421dd5f1b982d40a13b8baab31b17af1db7377
Opcode Fuzzy Hash: b0b7107fc35310d78eed3e98a50e4b64a6e60586d7792949686be8a88d2090bc
Instruction Fuzzy Hash: 1301A236B100294BDBA4D669DC20AAFB7EADBC8350F048139E50BD7340EE25CC0247D2

Uniqueness

Uniqueness Score: -1.00%

Function 06D73C80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7497168f6de99f3bf37bca2edc9ffce0a0d0daa67b1592b782be4e47799f906e
Instruction ID: aba8c97e799a98d91bc0eaa4bbeac2306cddcdc71dac786a92e566c3789fb338
Opcode Fuzzy Hash: 7497168f6de99f3bf37bca2edc9ffce0a0d0daa67b1592b782be4e47799f906e
Instruction Fuzzy Hash: 0F11B0B5D01259AFCB10DF9AD884ADEFFB4FB48710F10812AE918A7340D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D74208 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b0baf759ef10299e47fd5a0b19a925c0305d9661f3ab9950317e6f67f6bad5
Instruction ID: b9eacad68b6ce0f64ca9b0f6193d072fec074938e2e7c4c774d4466b4728f9de
Opcode Fuzzy Hash: 55b0baf759ef10299e47fd5a0b19a925c0305d9661f3ab9950317e6f67f6bad5
Instruction Fuzzy Hash: 84016231B100214BDBB59AAD941471FB3DBDBC6610F208439E60EC7344EA65DC1643D2

Uniqueness

Uniqueness Score: -1.00%

Function 06D7F190 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8119e30f419f4a7a3c84d498a65195ae758d0c91f944a8bbd0abb234845b13ec
Instruction ID: dfe29c9bef36d6ec4c25b3b36b8936843f73cf5f80f2b02e9ef2546352a96a00
Opcode Fuzzy Hash: 8119e30f419f4a7a3c84d498a65195ae758d0c91f944a8bbd0abb234845b13ec
Instruction Fuzzy Hash: C5018136B101154BDBB4D76C989072F73D6E7C9620F20883AF90AC7344EE25DC024382

Uniqueness

Uniqueness Score: -1.00%

Function 06D7CBCB Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb41936833735eb3cb99a9cda3c2985223028bd7ede66c78c212a03a2bd0be2
Instruction ID: 0ffc494e292ae315ccdbe7fcef90aa03d579479974cea563892b985ec5f78fb1
Opcode Fuzzy Hash: 8cb41936833735eb3cb99a9cda3c2985223028bd7ede66c78c212a03a2bd0be2
Instruction Fuzzy Hash: A101F931F202289FDF54AB79F85069AB776FB84310F108139E905EB344EB319C048BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06D7A308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a740d014658ab7892c490ba77e13d9c6e64420ae9701b96d9dd5e9e27e5683
Instruction ID: 903b16854c59e6b3a2e0892039f495c8d9bd838bb8ae35eccc7c51a3947502df
Opcode Fuzzy Hash: 73a740d014658ab7892c490ba77e13d9c6e64420ae9701b96d9dd5e9e27e5683
Instruction Fuzzy Hash: CF01A430B105154FDBA0EABCE46071F73D6E786711F248439E50ECB354EE21DC024782

Uniqueness

Uniqueness Score: -1.00%

Function 06D782B7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9f213a3b83914af283e1613bbbcaaa6e34726133a47019f9424440d96fc864
Instruction ID: cba05fa41ae2a7e8eb19a7d2f71ed37a15aacde80770e6d9ea71e15f4ca4efbe
Opcode Fuzzy Hash: 4c9f213a3b83914af283e1613bbbcaaa6e34726133a47019f9424440d96fc864
Instruction Fuzzy Hash: 39F08C31E00218DFDB649B98E99C6ACBBB1EB41312F584072D801E3254E331D982EB52

Uniqueness

Uniqueness Score: -1.00%

Function 06D76463 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f264093bf80adbb65ad20640c062d0708f1afa69e93a069c238efd71beae3c81
Instruction ID: c85e1cc3f46d054ac2d442074c2f59349bd42ab0a56c6a2109946d9716ca6736
Opcode Fuzzy Hash: f264093bf80adbb65ad20640c062d0708f1afa69e93a069c238efd71beae3c81
Instruction Fuzzy Hash: A3E0D870A197886FDB50CF708D1576A7BACD746208F208896E408CB102F136DE4193A2

Uniqueness

Uniqueness Score: -1.00%

Function 06D74A51 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2669464567.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6d70000_cbsBVT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734fbd5c0e64a0c76da22990692f4993856a0d882a44f86038d8c489e1750287
Instruction ID: 432b0b6b6a7e668669cf627f69fed6827ec9a166ba6eaa433c1fb93ae713d362
Opcode Fuzzy Hash: 734fbd5c0e64a0c76da22990692f4993856a0d882a44f86038d8c489e1750287
Instruction Fuzzy Hash: 14F0DA30E6021ADFDB14DF94E868BAEBBB2FF84704F204129E402A7284DB701C05CBC5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi_1.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cbsBVT.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ch0lgdmz.2ec.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cle1hxl3.tk0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eckwbzzv.zhy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fllulnlq.3yr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fowbeh4v.1ik.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvaj1xj5.uha.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdbheqwd.wwo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kg4hvtwm.cu1.psm1

Windows Analysis Report
hesaphareketi_1.scr.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre