Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe
Analysis ID:	1617367
MD5:	1174c68cc0963934ab411ae67c91e185
SHA1:	5872f7d68d6500c641755de2fc9c69019a269d6e
SHA256:	3f43d89c42b8785ad4ed9aecdc397dadd4f68084fb95af61c77e5acfb26fb7e1
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

Installs a global keyboard hook

Sample or dropped binary is a compiled AutoHotkey binary

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe (PID: 1420 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe" MD5: 1174C68CC0963934AB411AE67C91E185)

SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe (PID: 1096 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe" /script /f "\\.\pipe\AHKOFMNMJND" MD5: 1174C68CC0963934AB411AE67C91E185)

cmd.exe (PID: 1944 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" > "C:\Users\user\AppData\Local\Temp\hashresult.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2292 cmdline: powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Sigma Signatures

System Summary

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" , CommandLine: powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" > "C:\Users\user\AppData\Local\Temp\hashresult.txt", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1944, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash" , ProcessId: 2292, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T20:45:11.040725+0100	2028371	3	Unknown Traffic	192.168.2.9	49710	132.145.76.202	443	TCP
2025-02-17T20:45:12.050248+0100	2028371	3	Unknown Traffic	192.168.2.9	49711	132.145.76.202	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Virustotal: Detection: 22%			Perma Link
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	ReversingLabs: Detection: 18%

Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 132.145.76.202:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 132.145.76.202:443 -> 192.168.2.9:49711 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00000001400BA270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	0_2_00000001400BA370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,	0_2_00000001400742C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_000000014004A390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_000000014008E5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,	0_2_0000000140074620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	0_2_0000000140074C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	0_2_000000014008DFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_00000001400BA270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	2_2_00000001400BA370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,	2_2_00000001400742C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	2_2_000000014004A390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_000000014008E5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,	2_2_0000000140074620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	2_2_0000000140074C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	2_2_000000014008DFD0

Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49710 -> 132.145.76.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49711 -> 132.145.76.202:443

Source: global traffic	HTTP traffic detected: GET /hash2411/ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: nikantahk.ftp.sh
Source: global traffic	HTTP traffic detected: GET /check_key/TZDZQYYDYTZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: nikantahk.ftp.sh

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014008AE00 _wcstoi64,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,GetTickCount,PeekMessageW,GetTickCount,InternetReadFile,InternetReadFileExA,GetTickCount,PeekMessageW,GetTickCount,InternetReadFileExA,InternetCloseHandle,InternetCloseHandle,fclose,DeleteFileW,

0_2_000000014008AE00

Source: global traffic	HTTP traffic detected: GET /nikantahhk/skreenahkafk/refs/heads/main/install_ahk0_1.exe HTTP/1.1User-Agent: AutoHotkeyHost: raw.githubusercontent.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /hash2411/ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: nikantahk.ftp.sh
Source: global traffic	HTTP traffic detected: GET /check_key/TZDZQYYDYTZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: nikantahk.ftp.sh

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: nikantahk.ftp.sh

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3272543797.0000000140001000.00000040.00000001.01000000.00000003.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://autohotkey.com
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000000.00000002.1452412139.0000000140001000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3272543797.0000000140001000.00000040.00000001.01000000.00000003.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://autohotkey.comCould
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/L
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.0000000002890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/check_key/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3272174755.000000000606E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/check_key/TZDZQYYDYTZ8;
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1593318147.0000000006084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/check_key/TZDZQYYDYTZw
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.0000000002890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/check_key/p
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/hash241/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.0000000002890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/hash2411/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/hash2411/.
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/hash2411/1B
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.0000000002890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh/hash2411/H
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nikantahk.ftp.sh:443/hash2411/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://racom/nikantahrefs/heads/main/0.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raent.com/nikantah/heads/main/858.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000102000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000102000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/M
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/676.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/7685.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/832.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/833.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/836.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/837.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/839.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/843.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/846.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/858.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/9896.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/anti_afk.exe
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/bilet.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/bonusf10.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/conf.ini
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/dostf10.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/eda0.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/glosf10.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/goles.png
Source: install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/imeg_5vito.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/install_ahk0_1.exe
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/install_ahk0_1.exe3
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3271155323.0000000002890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/install_ahk0_1.exeinstall_
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/kazik.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/loter.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/password.ahk
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/password_secretive.ahk
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/pers.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/persf10.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/ragu.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/res2.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/shopf10.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/smuzi.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/test123.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583578696.0000000002955000.00000004.00000020.00020000.00000000.sdmp, install_ahk0_1.exe.2.dr	String found in binary or memory: https://raw.githubusercontent.com/nikantahhk/skreenahkafk/refs/heads/main/zadanf10.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.m/nikantahhkfs/heads/main/test123.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.t.com/nikantahhkeads/main/833.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.t.com/nikantahhkeads/main/peers.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rawnt.com/nikantahhheads/main/pe.ahk
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rtent.com/nikantas/heads/main/836.png
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rtent.com/nikantas/heads/mainini

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 132.145.76.202:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 132.145.76.202:443 -> 192.168.2.9:49711 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140007240 GetTickCount,OpenClipboard,GetTickCount,OpenClipboard,

0_2_0000000140007240

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BD430 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,	0_2_00000001400BD430
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140006EA0 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,	0_2_0000000140006EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BD430 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,	2_2_00000001400BD430
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140006EA0 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,	2_2_0000000140006EA0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140007120 GetClipboardFormatNameW,GetClipboardData,

0_2_0000000140007120

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140062000 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyCursor,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,

0_2_0000000140062000

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014001D180 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,SendInput,

0_2_000000014001D180

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140001BAC GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,PostMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,IsDialogMessageW,SetCurrentDirectoryW,KillTimer,		0_2_0000000140001BAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140001BAC GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,PostMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,IsDialogMessageW,SetCurrentDirectoryW,KillTimer,		2_2_0000000140001BAC

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Window found: window name: AutoHotkey			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Window found: window name: AutoHotkey			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140063220 RegisterClipboardFormatW,GetMenu,CheckMenuItem,MoveWindow,GetSysColor,SetBkColor,SetTextColor,GetSysColorBrush,CreateCompatibleDC,SelectObject,BitBlt,SelectObject,DeleteDC,DrawIconEx,ExcludeClipRect,CreateRectRgn,GetClipRgn,GetSysColorBrush,FillRgn,DeleteObject,GetClipBox,FillRect,GetClientRect,MoveWindow,MoveWindow,MoveWindow,InvalidateRect,ShowWindow,Shell_NotifyIconW,Shell_NotifyIconW,RegisterClipboardFormatW,SendMessageTimeoutW,PostMessageW,SendMessageTimeoutW,PostMessageW,inet_ntoa,_itow,NtdllDefWindowProc_W,	0_2_0000000140063220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3FEC ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A7FF8 NtdllDialogWndProc_W,	0_2_00000001400A7FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A404A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A404A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8060 NtdllDialogWndProc_W,	0_2_00000001400A8060
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A40A8 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A40A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A40D9 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A40D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A80D7 NtdllDialogWndProc_W,	0_2_00000001400A80D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A834C NtdllDialogWndProc_W,	0_2_00000001400A834C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006337B NtdllDefWindowProc_W,	0_2_000000014006337B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400633AE SetFocus,NtdllDefWindowProc_W,	0_2_00000001400633AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8760 NtdllDialogWndProc_W,	0_2_00000001400A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A87E8 GetClipBox,FillRect,NtdllDialogWndProc_W,	0_2_00000001400A87E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8834 NtdllDialogWndProc_W,	0_2_00000001400A8834
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8875 FillRect,SetBkColor,GetClassLongPtrW,FillRect,SetTextColor,SendMessageW,SendMessageW,DrawTextW,SetTextColor,NtdllDialogWndProc_W,	0_2_00000001400A8875
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400EE890 NtdllDefWindowProc_W,	0_2_00000001400EE890
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A89CF NtdllDialogWndProc_W,	0_2_00000001400A89CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A89F4 ScreenToClient,EnumChildWindows,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,	0_2_00000001400A89F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140063A99 PostMessageW,NtdllDefWindowProc_W,	0_2_0000000140063A99
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8AB8 NtdllDialogWndProc_W,	0_2_00000001400A8AB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8AD8 NtdllDialogWndProc_W,	0_2_00000001400A8AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8C16 ShowWindow,PostMessageW,NtdllDialogWndProc_W,	0_2_00000001400A8C16
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8C6D GetDlgCtrlID,NtdllDialogWndProc_W,	0_2_00000001400A8C6D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140063C96 NtdllDefWindowProc_W,	0_2_0000000140063C96
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A8CAC GetSysColor,SetTextColor,SetBkMode,GetStockObject,SetBkColor,SetBkColor,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,NtdllDialogWndProc_W,	0_2_00000001400A8CAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	0_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A7EA0 PostMessageW,PostMessageW,DragQueryPoint,ClientToScreen,EnumChildWindows,GetDlgCtrlID,PostMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00000001400A7EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3F8F ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3F8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A7F8D SendMessageW,PostMessageW,NtdllDialogWndProc_W,	0_2_00000001400A7F8D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3F85 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3F85
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3FBA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3FBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140063220 RegisterClipboardFormatW,GetMenu,CheckMenuItem,MoveWindow,GetSysColor,SetBkColor,SetTextColor,GetSysColorBrush,CreateCompatibleDC,SelectObject,BitBlt,SelectObject,DeleteDC,DrawIconEx,ExcludeClipRect,CreateRectRgn,GetClipRgn,GetSysColorBrush,FillRgn,DeleteObject,GetClipBox,FillRect,GetClientRect,MoveWindow,MoveWindow,MoveWindow,InvalidateRect,ShowWindow,Shell_NotifyIconW,Shell_NotifyIconW,RegisterClipboardFormatW,SendMessageTimeoutW,PostMessageW,SendMessageTimeoutW,PostMessageW,inet_ntoa,_itow,NtdllDefWindowProc_W,	2_2_0000000140063220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	2_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A7EA0 PostMessageW,PostMessageW,DragQueryPoint,ClientToScreen,EnumChildWindows,GetDlgCtrlID,PostMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_00000001400A7EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3FEC ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8FE2 NtdllDialogWndProc_W,	2_2_00000001400A8FE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A7FF8 NtdllDialogWndProc_W,	2_2_00000001400A7FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A404A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A404A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8060 NtdllDialogWndProc_W,	2_2_00000001400A8060
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A40A8 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A40A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A40D9 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A40D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A80D7 NtdllDialogWndProc_W,	2_2_00000001400A80D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A834C NtdllDialogWndProc_W,	2_2_00000001400A834C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006337B NtdllDefWindowProc_W,	2_2_000000014006337B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400633AE SetFocus,NtdllDefWindowProc_W,	2_2_00000001400633AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8760 NtdllDialogWndProc_W,	2_2_00000001400A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A87E8 GetClipBox,FillRect,NtdllDialogWndProc_W,	2_2_00000001400A87E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8834 NtdllDialogWndProc_W,	2_2_00000001400A8834
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8875 FillRect,SetBkColor,GetClassLongPtrW,FillRect,SetTextColor,SendMessageW,SendMessageW,DrawTextW,SetTextColor,NtdllDialogWndProc_W,	2_2_00000001400A8875
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400EE890 NtdllDefWindowProc_W,	2_2_00000001400EE890
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A89CF NtdllDialogWndProc_W,	2_2_00000001400A89CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A89F4 ScreenToClient,EnumChildWindows,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,	2_2_00000001400A89F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140063A99 PostMessageW,NtdllDefWindowProc_W,	2_2_0000000140063A99
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8AB8 NtdllDialogWndProc_W,	2_2_00000001400A8AB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8AD8 NtdllDialogWndProc_W,	2_2_00000001400A8AD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8C16 ShowWindow,PostMessageW,NtdllDialogWndProc_W,	2_2_00000001400A8C16
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8C6D GetDlgCtrlID,NtdllDialogWndProc_W,	2_2_00000001400A8C6D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140063C96 NtdllDefWindowProc_W,	2_2_0000000140063C96
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A8CAC GetSysColor,SetTextColor,SetBkMode,GetStockObject,SetBkColor,SetBkColor,GetSysColor,SetBkColor,GetSysColorBrush,GetSysColor,SetBkColor,GetSysColorBrush,NtdllDialogWndProc_W,	2_2_00000001400A8CAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3F8F ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3F8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A7F8D SendMessageW,PostMessageW,NtdllDialogWndProc_W,	2_2_00000001400A7F8D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3F85 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3F85
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3FBA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3FBA

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014006C870: _swprintf,CreateFileW,DeviceIoControl,CloseHandle,

0_2_000000014006C870

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_000000014008E640
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_000000014008E640

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400291A0	0_2_00000001400291A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140063220	0_2_0000000140063220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002A249	0_2_000000014002A249
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140033270	0_2_0000000140033270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400962C0	0_2_00000001400962C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140079310	0_2_0000000140079310
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140093390	0_2_0000000140093390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002B3D7	0_2_000000014002B3D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002A757	0_2_000000014002A757
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BC930	0_2_00000001400BC930
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140001BAC	0_2_0000000140001BAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140080F00	0_2_0000000140080F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140094FD1	0_2_0000000140094FD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140062000	0_2_0000000140062000
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400E5FF4	0_2_00000001400E5FF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005D01B	0_2_000000014005D01B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140014030	0_2_0000000140014030
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007D040	0_2_000000014007D040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140013050	0_2_0000000140013050
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005B090	0_2_000000014005B090
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DD098	0_2_00000001400DD098
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005E0A0	0_2_000000014005E0A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A00B0	0_2_00000001400A00B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DE0A4	0_2_00000001400DE0A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400710D0	0_2_00000001400710D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400E00DC	0_2_00000001400E00DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400570E0	0_2_00000001400570E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A60ED	0_2_00000001400A60ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140097110	0_2_0000000140097110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C110	0_2_000000014009C110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140059140	0_2_0000000140059140
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006D142	0_2_000000014006D142
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008D160	0_2_000000014008D160
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400821B0	0_2_00000001400821B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008B1D0	0_2_000000014008B1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400841F0	0_2_00000001400841F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007C1F0	0_2_000000014007C1F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400CA210	0_2_00000001400CA210
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400AC210	0_2_00000001400AC210
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400E1204	0_2_00000001400E1204
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BF220	0_2_00000001400BF220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140011270	0_2_0000000140011270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400722B0	0_2_00000001400722B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A32CB	0_2_00000001400A32CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005D2C8	0_2_000000014005D2C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400E62C8	0_2_00000001400E62C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A32D9	0_2_00000001400A32D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A32E4	0_2_00000001400A32E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006F320	0_2_000000014006F320
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005331B	0_2_000000014005331B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140087330	0_2_0000000140087330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140006370	0_2_0000000140006370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009A380	0_2_000000014009A380
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014000338D	0_2_000000014000338D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140016390	0_2_0000000140016390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A33A0	0_2_00000001400A33A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400703A0	0_2_00000001400703A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008A398	0_2_000000014008A398
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A33B9	0_2_00000001400A33B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A33C1	0_2_00000001400A33C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A33D7	0_2_00000001400A33D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140041408	0_2_0000000140041408
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140047420	0_2_0000000140047420
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140039420	0_2_0000000140039420
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001C430	0_2_000000014001C430
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400AA460	0_2_00000001400AA460
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004D490	0_2_000000014004D490
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005B49B	0_2_000000014005B49B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400574B0	0_2_00000001400574B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400684C0	0_2_00000001400684C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006E4C0	0_2_000000014006E4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001B4C0	0_2_000000014001B4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007A4E0	0_2_000000014007A4E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400594E0	0_2_00000001400594E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140043506	0_2_0000000140043506
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007B510	0_2_000000014007B510
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A5570	0_2_00000001400A5570
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014000F570	0_2_000000014000F570
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001D580	0_2_000000014001D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008958F	0_2_000000014008958F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006A5A0	0_2_000000014006A5A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400185A0	0_2_00000001400185A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400B55B0	0_2_00000001400B55B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A95C0	0_2_00000001400A95C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400585E0	0_2_00000001400585E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005C5E0	0_2_000000014005C5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140064610	0_2_0000000140064610
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005363B	0_2_000000014005363B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140067650	0_2_0000000140067650
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A565B	0_2_00000001400A565B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C66D	0_2_000000014009C66D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140082670	0_2_0000000140082670
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006C670	0_2_000000014006C670
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C67C	0_2_000000014009C67C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008869E	0_2_000000014008869E
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400666A0	0_2_00000001400666A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C698	0_2_000000014009C698
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C6BA	0_2_000000014009C6BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400196C0	0_2_00000001400196C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C6DB	0_2_000000014009C6DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C6E7	0_2_000000014009C6E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C70D	0_2_000000014009C70D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400AE720	0_2_00000001400AE720
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C74E	0_2_000000014009C74E
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002E750	0_2_000000014002E750
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140092760	0_2_0000000140092760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005E760	0_2_000000014005E760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400EC78C	0_2_00000001400EC78C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008D790	0_2_000000014008D790
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A6788	0_2_00000001400A6788
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014003F799	0_2_000000014003F799
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BE7C0	0_2_00000001400BE7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001F7C0	0_2_000000014001F7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009E7F8	0_2_000000014009E7F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140070810	0_2_0000000140070810
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014000280B	0_2_000000014000280B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140050830	0_2_0000000140050830
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004D830	0_2_000000014004D830
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400408A3	0_2_00000001400408A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004B8E0	0_2_000000014004B8E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400158E0	0_2_00000001400158E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006C940	0_2_000000014006C940
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004E970	0_2_000000014004E970
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140059980	0_2_0000000140059980
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A599C	0_2_00000001400A599C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007E9B0	0_2_000000014007E9B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140047A15	0_2_0000000140047A15
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005DA1D	0_2_000000014005DA1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A4A40	0_2_00000001400A4A40
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140069A50	0_2_0000000140069A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004FA70	0_2_000000014004FA70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A6A65	0_2_00000001400A6A65
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140060A80	0_2_0000000140060A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140021A90	0_2_0000000140021A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400B8AC0	0_2_00000001400B8AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140087AC0	0_2_0000000140087AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140072AE0	0_2_0000000140072AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005AB10	0_2_000000014005AB10
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006BB90	0_2_000000014006BB90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140012C30	0_2_0000000140012C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140042C35	0_2_0000000140042C35
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001DC50	0_2_000000014001DC50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BAC70	0_2_00000001400BAC70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400C4C80	0_2_00000001400C4C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005FC80	0_2_000000014005FC80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005DC82	0_2_000000014005DC82
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140055C90	0_2_0000000140055C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009BCA0	0_2_000000014009BCA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140023CA0	0_2_0000000140023CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140046D49	0_2_0000000140046D49
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007ED68	0_2_000000014007ED68
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400ECD70	0_2_00000001400ECD70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140058D70	0_2_0000000140058D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008BD90	0_2_000000014008BD90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140053D90	0_2_0000000140053D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400D4DC0	0_2_00000001400D4DC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140099DB3	0_2_0000000140099DB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DBDB4	0_2_00000001400DBDB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140091DD0	0_2_0000000140091DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140098DE0	0_2_0000000140098DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140076DE0	0_2_0000000140076DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A5DE1	0_2_00000001400A5DE1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008AE00	0_2_000000014008AE00
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140087E30	0_2_0000000140087E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140054E30	0_2_0000000140054E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3E60	0_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006AE60	0_2_000000014006AE60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001FE90	0_2_000000014001FE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007FEB0	0_2_000000014007FEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014007DED0	0_2_000000014007DED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140064EE0	0_2_0000000140064EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140037EE0	0_2_0000000140037EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A0EF0	0_2_00000001400A0EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014006DEF9	0_2_000000014006DEF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004CF20	0_2_000000014004CF20
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140051F50	0_2_0000000140051F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140057F60	0_2_0000000140057F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140065F90	0_2_0000000140065F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005EFD0	0_2_000000014005EFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014000AFE0	0_2_000000014000AFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140014030	2_2_0000000140014030
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140013050	2_2_0000000140013050
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C110	2_2_000000014009C110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400291A0	2_2_00000001400291A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400E1204	2_2_00000001400E1204
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140063220	2_2_0000000140063220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400722B0	2_2_00000001400722B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400962C0	2_2_00000001400962C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400E62C8	2_2_00000001400E62C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140079310	2_2_0000000140079310
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140093390	2_2_0000000140093390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002B3D7	2_2_000000014002B3D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005B49B	2_2_000000014005B49B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002A757	2_2_000000014002A757
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BE7C0	2_2_00000001400BE7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004FA70	2_2_000000014004FA70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140001BAC	2_2_0000000140001BAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140055C90	2_2_0000000140055C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008AE00	2_2_000000014008AE00
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3E60	2_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140037EE0	2_2_0000000140037EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140062000	2_2_0000000140062000
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400E5FF4	2_2_00000001400E5FF4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005D01B	2_2_000000014005D01B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007D040	2_2_000000014007D040
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005B090	2_2_000000014005B090
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DD098	2_2_00000001400DD098
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005E0A0	2_2_000000014005E0A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A00B0	2_2_00000001400A00B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DE0A4	2_2_00000001400DE0A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400710D0	2_2_00000001400710D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400E00DC	2_2_00000001400E00DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400570E0	2_2_00000001400570E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A60ED	2_2_00000001400A60ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140097110	2_2_0000000140097110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140059140	2_2_0000000140059140
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006D142	2_2_000000014006D142
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008D160	2_2_000000014008D160
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400821B0	2_2_00000001400821B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008B1D0	2_2_000000014008B1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400841F0	2_2_00000001400841F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007C1F0	2_2_000000014007C1F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400CA210	2_2_00000001400CA210
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AC210	2_2_00000001400AC210
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BF220	2_2_00000001400BF220
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002A249	2_2_000000014002A249
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140033270	2_2_0000000140033270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140011270	2_2_0000000140011270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A32CB	2_2_00000001400A32CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005D2C8	2_2_000000014005D2C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A32D9	2_2_00000001400A32D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A32E4	2_2_00000001400A32E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006F320	2_2_000000014006F320
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005331B	2_2_000000014005331B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140087330	2_2_0000000140087330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140006370	2_2_0000000140006370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009A380	2_2_000000014009A380
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014000338D	2_2_000000014000338D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140016390	2_2_0000000140016390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A33A0	2_2_00000001400A33A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400703A0	2_2_00000001400703A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008A398	2_2_000000014008A398
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A33B9	2_2_00000001400A33B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A33C1	2_2_00000001400A33C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A33D7	2_2_00000001400A33D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140041408	2_2_0000000140041408
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140047420	2_2_0000000140047420
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140039420	2_2_0000000140039420
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001C430	2_2_000000014001C430
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AA460	2_2_00000001400AA460
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004D490	2_2_000000014004D490
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400574B0	2_2_00000001400574B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400684C0	2_2_00000001400684C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006E4C0	2_2_000000014006E4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001B4C0	2_2_000000014001B4C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007A4E0	2_2_000000014007A4E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400594E0	2_2_00000001400594E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140043506	2_2_0000000140043506
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007B510	2_2_000000014007B510
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A5570	2_2_00000001400A5570
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014000F570	2_2_000000014000F570
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001D580	2_2_000000014001D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008958F	2_2_000000014008958F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006A5A0	2_2_000000014006A5A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400185A0	2_2_00000001400185A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400B55B0	2_2_00000001400B55B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A95C0	2_2_00000001400A95C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400585E0	2_2_00000001400585E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005C5E0	2_2_000000014005C5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140064610	2_2_0000000140064610
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005363B	2_2_000000014005363B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140067650	2_2_0000000140067650
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A565B	2_2_00000001400A565B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C66D	2_2_000000014009C66D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140082670	2_2_0000000140082670
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006C670	2_2_000000014006C670
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C67C	2_2_000000014009C67C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008869E	2_2_000000014008869E
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400666A0	2_2_00000001400666A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C698	2_2_000000014009C698
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C6BA	2_2_000000014009C6BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400196C0	2_2_00000001400196C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C6DB	2_2_000000014009C6DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C6E7	2_2_000000014009C6E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C70D	2_2_000000014009C70D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AE720	2_2_00000001400AE720
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C74E	2_2_000000014009C74E
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002E750	2_2_000000014002E750
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140092760	2_2_0000000140092760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005E760	2_2_000000014005E760
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400EC78C	2_2_00000001400EC78C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008D790	2_2_000000014008D790
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A6788	2_2_00000001400A6788
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014003F799	2_2_000000014003F799
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001F7C0	2_2_000000014001F7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009E7F8	2_2_000000014009E7F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140070810	2_2_0000000140070810
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014000280B	2_2_000000014000280B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140050830	2_2_0000000140050830
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004D830	2_2_000000014004D830
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400408A3	2_2_00000001400408A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004B8E0	2_2_000000014004B8E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400158E0	2_2_00000001400158E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BC930	2_2_00000001400BC930
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006C940	2_2_000000014006C940
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004E970	2_2_000000014004E970
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140059980	2_2_0000000140059980
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A599C	2_2_00000001400A599C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007E9B0	2_2_000000014007E9B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140047A15	2_2_0000000140047A15
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005DA1D	2_2_000000014005DA1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A4A40	2_2_00000001400A4A40
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140069A50	2_2_0000000140069A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A6A65	2_2_00000001400A6A65
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140060A80	2_2_0000000140060A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140021A90	2_2_0000000140021A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400B8AC0	2_2_00000001400B8AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140087AC0	2_2_0000000140087AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140072AE0	2_2_0000000140072AE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005AB10	2_2_000000014005AB10
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006BB90	2_2_000000014006BB90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140012C30	2_2_0000000140012C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140042C35	2_2_0000000140042C35
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001DC50	2_2_000000014001DC50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BAC70	2_2_00000001400BAC70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400C4C80	2_2_00000001400C4C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005FC80	2_2_000000014005FC80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005DC82	2_2_000000014005DC82
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009BCA0	2_2_000000014009BCA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140023CA0	2_2_0000000140023CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140046D49	2_2_0000000140046D49
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007ED68	2_2_000000014007ED68
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400ECD70	2_2_00000001400ECD70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140058D70	2_2_0000000140058D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008BD90	2_2_000000014008BD90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140053D90	2_2_0000000140053D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400D4DC0	2_2_00000001400D4DC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140099DB3	2_2_0000000140099DB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DBDB4	2_2_00000001400DBDB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140091DD0	2_2_0000000140091DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140098DE0	2_2_0000000140098DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140076DE0	2_2_0000000140076DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A5DE1	2_2_00000001400A5DE1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140087E30	2_2_0000000140087E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140054E30	2_2_0000000140054E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006AE60	2_2_000000014006AE60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001FE90	2_2_000000014001FE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AFEA0	2_2_00000001400AFEA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007FEB0	2_2_000000014007FEB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014007DED0	2_2_000000014007DED0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140064EE0	2_2_0000000140064EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A0EF0	2_2_00000001400A0EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140080F00	2_2_0000000140080F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014006DEF9	2_2_000000014006DEF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004CF20	2_2_000000014004CF20
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140051F50	2_2_0000000140051F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140057F60	2_2_0000000140057F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140065F90	2_2_0000000140065F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005EFD0	2_2_000000014005EFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140094FD1	2_2_0000000140094FD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014000AFE0	2_2_000000014000AFE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400ABEF0 appears 40 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 000000014004E5E0 appears 883 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400B9320 appears 38 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400D7260 appears 124 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400D7D74 appears 56 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400D77F8 appears 50 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 000000014000DA20 appears 58 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400EE238 appears 54 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400EEAA8 appears 34 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 000000014004E250 appears 124 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400E0AF0 appears 42 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400EE578 appears 32 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: String function: 00000001400D6A8C appears 759 times

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: install_ahk0_1.exe.2.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Static PE information: Section: .MPRESS1 ZLIB complexity 1.0003226298845471

Source: classification engine

Classification label: mal64.spyw.evad.winEXE@8/6@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014004FA70 _swprintf,CreateProcessW,CloseHandle,GetLastError,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,CloseHandle,GetLastError,FormatMessageW,

0_2_000000014004FA70

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_000000014008E640
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_000000014008E640

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014006C280 wcsncpy,GetDiskFreeSpaceExW,free,

0_2_000000014006C280

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014008E8D0 CreateToolhelp32Snapshot,Process32FirstW,_wcstoi64,Process32NextW,Process32NextW,CloseHandle,CloseHandle,CloseHandle,

0_2_000000014008E8D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014008D160 CoInitialize,CoCreateInstance,GetKeyboardLayout,GetFullPathNameW,free,CoUninitialize,

0_2_000000014008D160

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_00000001400BB4B0 LoadLibraryExW,EnumResourceNamesW,FindResourceW,LoadResource,LockResource,GetSystemMetrics,FindResourceW,LoadResource,LockResource,SizeofResource,CreateIconFromResourceEx,FreeLibrary,ExtractIconW,

0_2_00000001400BB4B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

File created: C:\Users\user\Desktop\install_ahk0_1.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Mutant created: \Sessions\1\BaseNamedObjects\Ahk_OnlyOne_2358411173
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Mutant created: \Sessions\1\BaseNamedObjects\AHK Keybd
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2052:120:WilError_03

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\hashresult.txt

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

File read: C:\Users\user\Desktop\conf.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Virustotal: Detection: 22%
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe" /script /f "\\.\pipe\AHKOFMNMJND"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' \| Select-Object -ExpandProperty Hash" > "C:\Users\user\AppData\Local\Temp\hashresult.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' \| Select-Object -ExpandProperty Hash"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe" /script /f "\\.\pipe\AHKOFMNMJND"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' \| Select-Object -ExpandProperty Hash" > "C:\Users\user\AppData\Local\Temp\hashresult.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' \| Select-Object -ExpandProperty Hash"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

File written: C:\Users\user\Desktop\conf.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Static PE information: Image base 0x140000000 > 0x60000000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Unpacked PE file: 0.2.SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe.140000000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Unpacked PE file: 2.2.SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe.140000000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_00000001400E3028 LoadLibraryW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00000001400E3028

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Static PE information: section name: .MPRESS1
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Static PE information: section name: .MPRESS2
Source: install_ahk0_1.exe.2.dr	Static PE information: section name: text

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DF2E0 push rbp; iretd		0_2_00000001400DF7D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DF2E0 push rbp; iretd		2_2_00000001400DF7D8

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Static PE information: section name: .MPRESS1 entropy: 7.999684975476973

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

File created: C:\Users\user\Desktop\install_ahk0_1.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3FEC ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DFE7 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DFE7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140062000 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyCursor,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,	0_2_0000000140062000
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DFF6 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DFF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A404A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A404A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A00B0 GetWindowLongW,GetWindowLongW,SetWindowPos,EnableWindow,GetWindowRect,GetClientRect,MulDiv,MulDiv,GetWindowRect,GetClientRect,MulDiv,MulDiv,_wcstoi64,IsWindow,SetParent,SetWindowLongPtrW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,	0_2_00000001400A00B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A40A8 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A40A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A40D9 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A40D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009C110 realloc,SendMessageW,MulDiv,MulDiv,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,COMRefPtr,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,SelectObject,ReleaseDC,SendMessageW,SendMessageW,GetClientRect,SetWindowLongW,SendMessageW,SetWindowLongW,MoveWindow,GetWindowRect,SendMessageW,GetWindowRect,MapWindowPoints,InvalidateRect,SetWindowPos,SetWindowPos,MapWindowPoints,	0_2_000000014009C110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400642E0 SendMessageW,IsWindowVisible,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,	0_2_00000001400642E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140087330 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,_swprintf,free,free,	0_2_0000000140087330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400AA460 SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,SetFocus,SendMessageW,ShowWindow,SetFocus,InvalidateRect,MapWindowPoints,InvalidateRect,	0_2_00000001400AA460
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BE5F0 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,	0_2_00000001400BE5F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BE7C0 GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,BringWindowToTop,	0_2_00000001400BE7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014005D972 IsZoomed,IsIconic,	0_2_000000014005D972
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400AE9D0 CheckMenuItem,CheckMenuItem,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetForegroundWindow,GetWindowThreadProcessId,SetForegroundWindow,SetForegroundWindow,TrackPopupMenuEx,PostMessageW,GetForegroundWindow,SetForegroundWindow,	0_2_00000001400AE9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BAA30 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,	0_2_00000001400BAA30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140060A80 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,_swprintf,free,ReleaseDC,SelectObject,DeleteDC,DeleteObject,free,free,GetPixel,ReleaseDC,free,free,	0_2_0000000140060A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140076B80 GetTickCount,GetForegroundWindow,GetTickCount,GetWindowThreadProcessId,GetGUIThreadInfo,ClientToScreen,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_itow,	0_2_0000000140076B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	0_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	0_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DF4D GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DF4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140051F50 IsWindow,DestroyWindow,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,MonitorFromPoint,GetMonitorInfoW,IsWindow,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,	0_2_0000000140051F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DF5D MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DF5D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DF55 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DF55
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DF6B MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DF6B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3F8F ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3F8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140065F90 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,GetClassNameW,EnumChildWindows,free,	0_2_0000000140065F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3F85 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3F85
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014009DFAF MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_000000014009DFAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400A3FBA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_00000001400A3FBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009C110 realloc,SendMessageW,MulDiv,MulDiv,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,COMRefPtr,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,SelectObject,ReleaseDC,SendMessageW,SendMessageW,GetClientRect,SetWindowLongW,SendMessageW,SetWindowLongW,MoveWindow,GetWindowRect,SendMessageW,GetWindowRect,MapWindowPoints,InvalidateRect,SetWindowPos,SetWindowPos,MapWindowPoints,	2_2_000000014009C110
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BE5F0 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,	2_2_00000001400BE5F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BE7C0 GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,BringWindowToTop,	2_2_00000001400BE7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	2_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	2_2_00000001400A3E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3FEC ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DFE7 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DFE7
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140062000 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyCursor,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,	2_2_0000000140062000
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DFF6 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DFF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A404A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A404A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A00B0 GetWindowLongW,GetWindowLongW,SetWindowPos,EnableWindow,GetWindowRect,GetClientRect,MulDiv,MulDiv,GetWindowRect,GetClientRect,MulDiv,MulDiv,_wcstoi64,IsWindow,SetParent,SetWindowLongPtrW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,	2_2_00000001400A00B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A40A8 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A40A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A40D9 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A40D9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400642E0 SendMessageW,IsWindowVisible,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,	2_2_00000001400642E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140087330 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,_swprintf,free,free,	2_2_0000000140087330
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AA460 SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,SetFocus,SendMessageW,ShowWindow,SetFocus,InvalidateRect,MapWindowPoints,InvalidateRect,	2_2_00000001400AA460
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014005D972 IsZoomed,IsIconic,	2_2_000000014005D972
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400AE9D0 CheckMenuItem,CheckMenuItem,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetForegroundWindow,GetWindowThreadProcessId,SetForegroundWindow,SetForegroundWindow,TrackPopupMenuEx,PostMessageW,GetForegroundWindow,SetForegroundWindow,	2_2_00000001400AE9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BAA30 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,	2_2_00000001400BAA30
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140060A80 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,_swprintf,free,ReleaseDC,SelectObject,DeleteDC,DeleteObject,free,free,GetPixel,ReleaseDC,free,free,	2_2_0000000140060A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140076B80 GetTickCount,GetForegroundWindow,GetTickCount,GetWindowThreadProcessId,GetGUIThreadInfo,ClientToScreen,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_itow,	2_2_0000000140076B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DF4D GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DF4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140051F50 IsWindow,DestroyWindow,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,MonitorFromPoint,GetMonitorInfoW,IsWindow,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,	2_2_0000000140051F50
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DF5D MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DF5D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DF55 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DF55
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DF6B MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DF6B
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3F8F ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3F8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140065F90 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,GetClassNameW,EnumChildWindows,free,	2_2_0000000140065F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3F85 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3F85
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014009DFAF MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	2_2_000000014009DFAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400A3FBA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,NtdllDialogWndProc_W,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	2_2_00000001400A3FBA

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4633			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1717			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Dropped PE file which has not been started: C:\Users\user\Desktop\install_ahk0_1.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	API coverage: 1.1 %
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe TID: 2072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656	Thread sleep count: 4633 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656	Thread sleep count: 1717 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMv2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D407
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D407
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D416
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D416
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D43D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D43D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D461
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D461
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	0_2_000000014002D485
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	0_2_000000014002D485
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014001D580 GetKeyboardLayout followed by cmp: cmp ecx, 0ah and CTI: jl 000000014001D8E2h country: Spanish (es)	0_2_000000014001D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140022C90 GetKeyboardLayout followed by cmp: cmp dl, 00000019h and CTI: ja 0000000140022E0Dh country: Russian (ru)	0_2_0000000140022C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D407
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D407
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D40F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D416
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D416
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D43D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D43D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D461
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D461
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)	2_2_000000014002D485
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)	2_2_000000014002D485
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014001D580 GetKeyboardLayout followed by cmp: cmp ecx, 0ah and CTI: jl 000000014001D8E2h country: Spanish (es)	2_2_000000014001D580
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140022C90 GetKeyboardLayout followed by cmp: cmp dl, 00000019h and CTI: ja 0000000140022E0Dh country: Russian (ru)	2_2_0000000140022C90

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400666A0 GetLocalTime followed by cmp: cmp word ptr [rbx], cx and CTI: je 00000001400669D3h	0_2_00000001400666A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400666A0 GetLocalTime followed by cmp: cmp dx, ax and CTI: je 0000000140066893h	0_2_00000001400666A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400666A0 GetLocalTime followed by cmp: cmp word ptr [rbx], cx and CTI: je 00000001400669D3h	2_2_00000001400666A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400666A0 GetLocalTime followed by cmp: cmp dx, ax and CTI: je 0000000140066893h	2_2_00000001400666A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00000001400BA270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	0_2_00000001400BA370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,	0_2_00000001400742C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_000000014004A390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_000000014008E5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,	0_2_0000000140074620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	0_2_0000000140074C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	0_2_000000014008DFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_00000001400BA270
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	2_2_00000001400BA370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,	2_2_00000001400742C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	2_2_000000014004A390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_000000014008E5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,	2_2_0000000140074620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	2_2_0000000140074C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	2_2_000000014008DFD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000099000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP~
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000003.1583462462.0000000000126000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270369288.0000000000126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140020570 BlockInput,free,BlockInput,

0_2_0000000140020570

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_00000001400DF2C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00000001400DF2C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

0_2_00000001400E3028

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_00000001400E7758 GetProcessHeap,RtlAllocateHeap,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,

0_2_00000001400E7758

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DF2C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00000001400DF2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_00000001400DB8A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00000001400DB8A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DF2C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00000001400DF2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_00000001400DB8A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00000001400DB8A8

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

0_2_000000014004FA70

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014001F7C0 GetCurrentThreadId,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,BlockInput,GetForegroundWindow,GetAsyncKeyState,keybd_event,GetAsyncKeyState,keybd_event,GetAsyncKeyState,BlockInput,

0_2_000000014001F7C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014008E770 mouse_event,

0_2_000000014008E770

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Get-FileHash -Algorithm SHA256 'C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe' | Select-Object -ExpandProperty Hash"

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: Program Manager
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3270909559.00000000007F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000000.00000002.1452412139.0000000140001000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe, 00000002.00000002.3272543797.0000000140001000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: TextLEFTLRIGHTRMIDDLEMX1X2WUWDWLWR{Blind}{ClickLl{}^+!#{}RawTempASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt SYSTEM\CurrentControlSet\Control\Keyboard Layouts\Layout FileKbdLayerDescriptorsc%03Xvk%02XSCALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUPRtlGetVersionntdll.dll%u.%u.%uStdOutAllUnreachableClassOverwriteUseEnvLocalSameAsGlobalUseUnsetGlobalUseUnsetLocalYYYYYWeekYearYDayWorkingDirWinDirWinDelayWDayUserNameTitleMatchModeSpeedTitleMatchModeTimeSinceThisHotkeyTimeSincePriorHotkeyTimeIdlePhysicalTimeIdleMouseTimeIdleKeyboardTimeIdleTickCountThisMenuItemPosThisMenuItemThisMenuThisLabelThisHotkeyThisFuncStoreCapslockModeStartupCommonStartupStartMenuCommonStartMenuSecScriptNameScriptHwndScriptFullPathScriptDirScreenWidthScreenHeightScreenDPIRegViewPtrSizeProgramsCommonProgramsPriorKeyPriorHotkeyOSVersionOSTypeNumBatchLinesNowUTCNowMyDocumentsMSecMouseDelayPlayMouseDelayMonMMMMMMMMMMinMDayLoopRegTypeLoopRegTimeModifiedLoopRegSubKeyLoopRegNameLoopRegKeyLoopReadLineLoopFileTimeModifiedLoopFileTimeCreatedLoopFileTimeAccessedLoopFileSizeMBLoopFileSizeKBLoopFileSizeLoopFileShortPathLoopFileShortNameLoopFilePathLoopFileNameLoopFileLongPathLoopFileFullPathLoopFileExtLoopFileDirLoopFileAttribLoopFieldLineNumberLineFileLastErrorLanguageKeyDurationPlayKeyDurationKeyDelayPlayKeyDelayIsUnicodeIsSuspendedIsPausedIsCriticalIsCompiledIsAdminIs64bitOSIPAddress4IPAddress3IPAddress2IPAddress1InitialWorkingDirIndexIconTipIconNumberIconHiddenIconFileHourGuiYGuiXGuiWidthGuiHeightGuiEventGuiControlEventFormatIntegerFormatFloatExitReasonEventInfoEndCharDesktopCommonDesktopDefaultTreeViewDefaultMouseSpeedDefaultListViewDefaultGuiDDDDDDDDDCursorCoordModeToolTipCoordModePixelCoordModeMouseCoordModeMenuCoordModeCaretControlDelayComputerNameCaretYCaretXBatchLinesAppDataCommonAppDataAhkVersionAhkPathTrueProgramFilesFalseComSpecClipboardAllClipboard...%s[%Iu of %Iu]: %-1.60s%sPropertyRegExMatch\:\:REG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYDefault3264MasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWMonitorCountMonitorPrimaryMonitorMonitorWorkAreaMonitorNameAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightShowAddRenameCheckUncheckToggleCheckEnableDisableToggleEnableStandardNoStandardColorNoDefaultDeleteAllTipIconNoIconMainWindowNoMainWindowSubmitCancelHideMinimizeMaximizeRestoreDestroyMarginFontListViewTreeViewFlashNewMoveMoveDrawFocusChooseChooseStringPosFocusVEnabledVisibleHwndNameButtonCheckboxRadioDDLDropDownListComboBoxListBoxUpDownSliderTab2Tab3GroupBoxPicPictureDateTimeMonthCalStatusBarActiveXLinkCustomPriorityInterruptNoTimersCloseWaitCloseStyleExStyleShowDropDownHideDropDownTabLeftTabRightEditPasteCheckedFindStringChoiceListLineCountCurrentLineCurrentColSelectedEjectLockUnlockLabelFileSystemFSSetLabel:SerialTypeStatus
Source: install_ahk0_1.exe.2.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_000000014002A757 GetFileAttributesW,SetCurrentDirectoryW,free,GetSystemTimeAsFileTime,

0_2_000000014002A757

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140076750 GetComputerNameW,GetUserNameW,

0_2_0000000140076750

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Code function: 0_2_0000000140023EA0 GetModuleHandleW,GetProcAddress,GetVersionExW,

0_2_0000000140023EA0

Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: WIN_XP
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: WIN_VISTA
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: WIN_7
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: WIN_8
Source: install_ahk0_1.exe.2.dr	Binary or memory string: ?A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingleWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003%04hX0x%IxpPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkCountarraypcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fCallbackFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfo
Source: SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Binary or memory string: WIN_8.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140028980 Shell_NotifyIconW,RemoveClipboardFormatListener,ChangeClipboardChain,DestroyWindow,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,mciSendStringW,mciSendStringW,RtlDeleteCriticalSection,OleUninitialize,free,free,free,	0_2_0000000140028980
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140029620 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,	0_2_0000000140029620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 0_2_0000000140080CE0 RemoveClipboardFormatListener,ChangeClipboardChain,	0_2_0000000140080CE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140029620 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,	2_2_0000000140029620
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140028980 Shell_NotifyIconW,RemoveClipboardFormatListener,ChangeClipboardChain,DestroyWindow,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyCursor,DestroyCursor,IsWindow,DestroyWindow,DeleteObject,mciSendStringW,mciSendStringW,RtlDeleteCriticalSection,OleUninitialize,free,free,free,	2_2_0000000140028980
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe	Code function: 2_2_0000000140080CE0 RemoveClipboardFormatListener,ChangeClipboardChain,	2_2_0000000140080CE0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	121 Input Capture	11 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.6050.24821.exe