Loading ...

Play interactive tourEdit tour

Windows Analysis Report SOA pdf.exe

Overview

General Information

Sample Name:SOA pdf.exe
Analysis ID:510693
MD5:a4777dd931c6b16901478a2c1888dc27
SHA1:bac3170333a0c8da9e5e1827d065d78b683fbb53
SHA256:59bb800d65d8c2670fe30e036b9d9d7e81ab3a863df72e1f00e27c709ddcf1e8
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • SOA pdf.exe (PID: 5552 cmdline: 'C:\Users\user\Desktop\SOA pdf.exe' MD5: A4777DD931C6B16901478A2C1888DC27)
    • schtasks.exe (PID: 6392 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpAF7F.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • SOA pdf.exe (PID: 6484 cmdline: {path} MD5: A4777DD931C6B16901478A2C1888DC27)
  • hgvQCmQ.exe (PID: 240 cmdline: 'C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe' MD5: A4777DD931C6B16901478A2C1888DC27)
    • schtasks.exe (PID: 6344 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmp9A6B.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 1636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • hgvQCmQ.exe (PID: 5344 cmdline: {path} MD5: A4777DD931C6B16901478A2C1888DC27)
  • hgvQCmQ.exe (PID: 396 cmdline: 'C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe' MD5: A4777DD931C6B16901478A2C1888DC27)
    • schtasks.exe (PID: 400 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpBCF7.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • hgvQCmQ.exe (PID: 5868 cmdline: {path} MD5: A4777DD931C6B16901478A2C1888DC27)
    • hgvQCmQ.exe (PID: 6620 cmdline: {path} MD5: A4777DD931C6B16901478A2C1888DC27)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "markhung@jingtai.com.vn", "Password": "truongtuyen2209", "Host": "Mail.jingtai.com.vn"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000001A.00000000.553026976.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000001A.00000000.553026976.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000012.00000000.523738351.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 52 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.SOA pdf.exe.3f5dab8.3.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.SOA pdf.exe.3f5dab8.3.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                4.0.SOA pdf.exe.400000.12.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  4.0.SOA pdf.exe.400000.12.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    26.0.hgvQCmQ.exe.400000.10.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 49 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 26.0.hgvQCmQ.exe.400000.4.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "markhung@jingtai.com.vn", "Password": "truongtuyen2209", "Host": "Mail.jingtai.com.vn"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: SOA pdf.exeReversingLabs: Detection: 25%
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\SneJGPA.exeReversingLabs: Detection: 25%
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeReversingLabs: Detection: 25%
                      Machine Learning detection for sampleShow sources
                      Source: SOA pdf.exeJoe Sandbox ML: detected
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\SneJGPA.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeJoe Sandbox ML: detected
                      Source: 26.0.hgvQCmQ.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.hgvQCmQ.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.SOA pdf.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.SOA pdf.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 26.0.hgvQCmQ.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.SOA pdf.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.hgvQCmQ.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.hgvQCmQ.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.SOA pdf.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.2.hgvQCmQ.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 26.0.hgvQCmQ.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.0.SOA pdf.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.hgvQCmQ.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 26.0.hgvQCmQ.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 26.2.hgvQCmQ.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 18.0.hgvQCmQ.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: 26.0.hgvQCmQ.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 4.2.SOA pdf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: SOA pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: SOA pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49770 -> 103.15.48.233:587
                      Source: SOA pdf.exe, 00000004.00000002.630306300.0000000002871000.00000004.00000001.sdmp, hgvQCmQ.exe, 00000012.00000002.574206873.0000000002941000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: hgvQCmQ.exe, 0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: SOA pdf.exe, 00000004.00000002.632033522.0000000002BD0000.00000004.00000001.sdmpString found in binary or memory: http://Mail.jingtai.com.vn
                      Source: SOA pdf.exe, 00000004.00000002.630306300.0000000002871000.00000004.00000001.sdmpString found in binary or memory: http://bWFhc41K6WqcMA6O.net
                      Source: SOA pdf.exe, 00000004.00000002.630306300.0000000002871000.00000004.00000001.sdmpString found in binary or memory: http://bWFhc41K6WqcMA6O.nett
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: SOA pdf.exe, 00000004.00000002.632033522.0000000002BD0000.00000004.00000001.sdmpString found in binary or memory: http://pro13.emailserver.vn
                      Source: hgvQCmQ.exe, 0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpString found in binary or memory: http://rlhupJ.com
                      Source: SOA pdf.exe, 00000001.00000002.399462595.0000000002CC1000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000B.00000002.528563461.0000000002711000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP
                      Source: hgvQCmQ.exe, hgvQCmQ.exe, 0000000E.00000000.507259966.00000000008A2000.00000002.00020000.sdmp, hgvQCmQ.exe, 00000012.00000000.515358909.00000000004A2000.00000002.00020000.sdmp, hgvQCmQ.exe, 00000017.00000002.543098518.0000000000182000.00000002.00020000.sdmp, hgvQCmQ.exe, 0000001A.00000000.543649045.00000000006D2000.00000002.00020000.sdmp, SOA pdf.exeString found in binary or memory: http://tempuri.org/DatabaseDataSet.xsd
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: SOA pdf.exe, 00000001.00000003.358166526.0000000005E9C000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/5
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: SOA pdf.exe, 00000001.00000003.360096130.0000000005E92000.00000004.00000001.sdmp, SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com4P
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comalsZP)
                      Source: SOA pdf.exe, 00000001.00000002.403233802.0000000005E80000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comcom
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comd
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comitud
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comlicd
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comsiva=P
                      Source: SOA pdf.exe, 00000001.00000003.360835511.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com~P
                      Source: SOA pdf.exe, 00000001.00000003.351784655.0000000005EBD000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: SOA pdf.exe, 00000001.00000003.351784655.0000000005EBD000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com9
                      Source: SOA pdf.exe, 00000001.00000003.351784655.0000000005EBD000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comX
                      Source: SOA pdf.exe, 00000001.00000003.351784655.0000000005EBD000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comy
                      Source: SOA pdf.exe, 00000001.00000003.353685426.0000000005E91000.00000004.00000001.sdmp, SOA pdf.exe, 00000001.00000003.353431356.0000000005E83000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: SOA pdf.exe, 00000001.00000003.353431356.0000000005E83000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn5
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: SOA pdf.exe, 00000001.00000003.355755914.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: SOA pdf.exe, 00000001.00000003.355755914.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/=P
                      Source: SOA pdf.exe, 00000001.00000003.356034926.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
                      Source: SOA pdf.exe, 00000001.00000003.356034926.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/=P
                      Source: SOA pdf.exe, 00000001.00000003.356034926.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/QP
                      Source: SOA pdf.exe, 00000001.00000003.355755914.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/~P
                      Source: SOA pdf.exe, 00000001.00000003.355755914.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/s/r
                      Source: SOA pdf.exe, 00000001.00000003.355632091.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/soft
                      Source: SOA pdf.exe, 00000001.00000003.355755914.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/uP
                      Source: SOA pdf.exe, 00000001.00000003.356034926.0000000005E86000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/~P
                      Source: SOA pdf.exe, 00000001.00000003.357582998.0000000005EC6000.00000004.00000001.sdmpString found in binary or memory: http://www.monotype.4
                      Source: SOA pdf.exe, 00000001.00000003.351269595.000000000135D000.00000004.00000001.sdmp, SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: SOA pdf.exe, 00000001.00000003.351269595.000000000135D000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comiv4
                      Source: SOA pdf.exe, 00000001.00000003.351269595.000000000135D000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comn
                      Source: SOA pdf.exe, 00000001.00000003.351269595.000000000135D000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comn-u
                      Source: SOA pdf.exe, 00000001.00000003.351269595.000000000135D000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comt
                      Source: SOA pdf.exe, 00000001.00000003.356579402.0000000005E92000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: SOA pdf.exe, 00000001.00000003.355033550.0000000005E9B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comI
                      Source: SOA pdf.exe, 00000001.00000003.355033550.0000000005E9B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comslnt
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: SOA pdf.exe, 00000001.00000003.357933861.0000000005E9E000.00000004.00000001.sdmp, SOA pdf.exe, 00000001.00000003.360930293.0000000005E92000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de
                      Source: SOA pdf.exe, 00000001.00000003.358166526.0000000005E9C000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.de3
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: SOA pdf.exe, 00000001.00000003.358166526.0000000005E9C000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deFy
                      Source: SOA pdf.exe, 00000001.00000003.358166526.0000000005E9C000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deras
                      Source: SOA pdf.exe, 00000001.00000002.403522952.0000000007092000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: SOA pdf.exe, 00000001.00000002.401458000.00000000040A6000.00000004.00000001.sdmp, SOA pdf.exe, 00000004.00000002.622548824.0000000000402000.00000040.00000001.sdmp, hgvQCmQ.exe, 0000000B.00000002.532515883.0000000003850000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000E.00000002.574319167.0000000003EA0000.00000004.00000001.sdmp, hgvQCmQ.exe, 00000012.00000000.523738351.0000000000402000.00000040.00000001.sdmp, hgvQCmQ.exe, 0000001A.00000000.553026976.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: SOA pdf.exe, 00000004.00000002.630306300.0000000002871000.00000004.00000001.sdmp, hgvQCmQ.exe, 00000012.00000002.574206873.0000000002941000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000001A.00000002.629021312.0000000002B11000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: Mail.jingtai.com.vn
                      Source: SOA pdf.exe, 00000001.00000002.398891854.00000000010C0000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      Spam, unwanted Advertisements and Ransom Demands:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 4.0.SOA pdf.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b0C8D2557u002d3889u002d400Fu002d9406u002d4B6CD9A29432u007d/u00312392A79u002dCB08u002d4B04u002d977Eu002d4794EB500DC5.csLarge array initialization: .cctor: array initializer size 11944
                      Source: 4.0.SOA pdf.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b0C8D2557u002d3889u002d400Fu002d9406u002d4B6CD9A29432u007d/u00312392A79u002dCB08u002d4B04u002d977Eu002d4794EB500DC5.csLarge array initialization: .cctor: array initializer size 11944
                      Source: SOA pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_02CAE1511_2_02CAE151
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_02CAC4B01_2_02CAC4B0
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_02CA9BF01_2_02CA9BF0
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075EF7881_2_075EF788
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075EE8081_2_075EE808
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E7D981_2_075E7D98
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E00401_2_075E0040
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E00061_2_075E0006
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_079547881_2_07954788
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_079533B81_2_079533B8
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_07958E321_2_07958E32
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_0795CA781_2_0795CA78
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_079581401_2_07958140
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_07954C601_2_07954C60
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_079533A91_2_079533A9
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_07950BE01_2_07950BE0
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_07958B121_2_07958B12
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_07950B301_2_07950B30
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_027247A04_2_027247A0
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_02723CCC4_2_02723CCC
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_027246B04_2_027246B0
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_027254904_2_02725490
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B075384_2_05B07538
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B094F84_2_05B094F8
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B069204_2_05B06920
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B0E4604_2_05B0E460
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B06C684_2_05B06C68
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_0259B35C11_2_0259B35C
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_0259E17011_2_0259E170
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_02599BF011_2_02599BF0
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_04C1478811_2_04C14788
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_04C1477811_2_04C14778
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_06A0F78811_2_06A0F788
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_06A0000611_2_06A00006
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_06A0004011_2_06A00040
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_06A07D9811_2_06A07D98
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_02BDB35C14_2_02BDB35C
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_02BDE17014_2_02BDE170
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_02BDC70814_2_02BDC708
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_02BD9BF014_2_02BD9BF0
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823E80814_2_0823E808
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_082398C014_2_082398C0
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823F78814_2_0823F788
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823000614_2_08230006
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823004014_2_08230040
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823EC0014_2_0823EC00
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_08237D9814_2_08237D98
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C4C6014_2_085C4C60
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C80B814_2_085C80B8
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C8DB814_2_085C8DB8
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085CCB0014_2_085CCB00
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C479814_2_085C4798
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C33B814_2_085C33B8
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C004014_2_085C0040
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C907014_2_085C9070
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C000614_2_085C0006
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C389114_2_085C3891
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C908014_2_085C9080
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C80A914_2_085C80A9
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C38A014_2_085C38A0
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C515014_2_085C5150
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C514014_2_085C5140
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C553C14_2_085C553C
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C69DF14_2_085C69DF
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C51F214_2_085C51F2
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C89E814_2_085C89E8
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C8DAA14_2_085C8DAA
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C39A714_2_085C39A7
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C6A3014_2_085C6A30
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C8A9814_2_085C8A98
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C8A8814_2_085C8A88
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C0B3014_2_085C0B30
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C0BE014_2_085C0BE0
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C478814_2_085C4788
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C33A914_2_085C33A9
                      Source: SOA pdf.exe, 00000001.00000002.403921801.0000000007670000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000001.00000002.403751978.0000000007480000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameBunifu.UI.dll4 vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000001.00000002.398167836.00000000009AE000.00000002.00020000.sdmpBinary or memory string: OriginalFilename6bpLA.exe4 vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000001.00000002.398891854.00000000010C0000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000001.00000002.399462595.0000000002CC1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamebUkmBySTvXsKXLZKazvODwwtAMdjm.exe4 vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000004.00000000.394195454.00000000005AE000.00000002.00020000.sdmpBinary or memory string: OriginalFilename6bpLA.exe4 vs SOA pdf.exe
                      Source: SOA pdf.exe, 00000004.00000002.622548824.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamebUkmBySTvXsKXLZKazvODwwtAMdjm.exe4 vs SOA pdf.exe
                      Source: SOA pdf.exeBinary or memory string: OriginalFilename6bpLA.exe4 vs SOA pdf.exe
                      Source: SOA pdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SneJGPA.exe.1.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: hgvQCmQ.exe.4.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: SOA pdf.exeReversingLabs: Detection: 25%
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile read: C:\Users\user\Desktop\SOA pdf.exeJump to behavior
                      Source: SOA pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\SOA pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\SOA pdf.exe 'C:\Users\user\Desktop\SOA pdf.exe'
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpAF7F.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Users\user\Desktop\SOA pdf.exe {path}
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe 'C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe'
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe 'C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe'
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmp9A6B.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpBCF7.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpAF7F.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Users\user\Desktop\SOA pdf.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmp9A6B.tmp'Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpBCF7.tmp'Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile created: C:\Users\user\AppData\Roaming\SneJGPA.exeJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile created: C:\Users\user\AppData\Local\Temp\tmpAF7F.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.adwa.evad.winEXE@20/9@2/0
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: SOA pdf.exeJoe Sandbox Cloud Basic: Detection: clean Score: 0Perma Link
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5648:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1636:120:WilError_01
                      Source: 4.0.SOA pdf.exe.400000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 4.0.SOA pdf.exe.400000.6.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 4.0.SOA pdf.exe.400000.12.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 4.0.SOA pdf.exe.400000.12.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: SOA pdf.exeStatic file information: File size 1221632 > 1048576
                      Source: SOA pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: SOA pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_008957B2 push esi; ret 1_2_008957B3
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_008983FB push ecx; retf 1_2_008983FC
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_00896721 push 6F060001h; retn 0004h1_2_0089673D
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E2B34 push es; ret 1_2_075E2B35
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E2A50 push es; ret 1_2_075E2A52
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E124D push ds; ret 1_2_075E124F
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E323D push ds; iretd 1_2_075E3243
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E1AD5 push ss; ret 1_2_075E1AD7
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E1AF9 push ss; ret 1_2_075E1AFB
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E1A82 push ss; ret 1_2_075E1A83
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E22BC push cs; ret 1_2_075E22BD
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 1_2_075E12A4 push ds; ret 1_2_075E12A6
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_00496721 push 6F060001h; retn 0004h4_2_0049673D
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_004983FB push ecx; retf 4_2_004983FC
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_004957B2 push esi; ret 4_2_004957B3
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B0D4B7 push eax; ret 4_2_05B0D4CD
                      Source: C:\Users\user\Desktop\SOA pdf.exeCode function: 4_2_05B0F926 pushfd ; ret 4_2_05B0F927
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_00256721 push 6F060001h; retn 0004h11_2_0025673D
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_002557B2 push esi; ret 11_2_002557B3
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_002583FB push ecx; retf 11_2_002583FC
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_04C19A70 pushad ; iretd 11_2_04C19A71
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 11_2_06A0323D push ds; iretd 11_2_06A03243
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_008A57B2 push esi; ret 14_2_008A57B3
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_008A83FB push ecx; retf 14_2_008A83FC
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_008A6721 push 6F060001h; retn 0004h14_2_008A673D
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_02BD7FC0 push edx; ret 14_2_02BD8154
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_0823323D push ds; iretd 14_2_08233243
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeCode function: 14_2_085C6DEC push eax; ret 14_2_085C6DED
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.20610912902
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.20610912902
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.20610912902
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeJump to dropped file
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile created: C:\Users\user\AppData\Roaming\SneJGPA.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpAF7F.tmp'
                      Source: C:\Users\user\Desktop\SOA pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run hgvQCmQJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run hgvQCmQJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile opened: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 0000000B.00000002.531462689.0000000002A6E000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SOA pdf.exe PID: 5552, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: hgvQCmQ.exe PID: 240, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: hgvQCmQ.exe PID: 396, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: SOA pdf.exe, 00000001.00000002.399462595.0000000002CC1000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000B.00000002.531462689.0000000002A6E000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: SOA pdf.exe, 00000001.00000002.399462595.0000000002CC1000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000B.00000002.531462689.0000000002A6E000.00000004.00000001.sdmp, hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\SOA pdf.exe TID: 6164Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exe TID: 6828Thread sleep time: -16602069666338586s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exe TID: 6832Thread sleep count: 275 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exe TID: 6832Thread sleep count: 9581 > 30Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe TID: 4928Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe TID: 6284Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe TID: 7120Thread sleep time: -20291418481080494s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe TID: 7136Thread sleep count: 923 > 30
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe TID: 7136Thread sleep count: 8906 > 30
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\SOA pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\SOA pdf.exeWindow / User API: threadDelayed 9581Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWindow / User API: threadDelayed 923
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWindow / User API: threadDelayed 8906
                      Source: C:\Users\user\Desktop\SOA pdf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeThread delayed: delay time: 922337203685477
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: hgvQCmQ.exe, 0000000E.00000002.568468445.0000000002D61000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: SOA pdf.exe, 00000004.00000002.628297222.0000000000C67000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess token adjusted: Debug
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\SOA pdf.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\SOA pdf.exeMemory written: C:\Users\user\Desktop\SOA pdf.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeMemory written: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeMemory written: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpAF7F.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeProcess created: C:\Users\user\Desktop\SOA pdf.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmp9A6B.tmp'Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\SneJGPA' /XML 'C:\Users\user\AppData\Local\Temp\tmpBCF7.tmp'Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exeProcess created: C:\Users\user\AppData\Roaming\hgvQCmQ\hgvQCmQ.exe {path}Jump to behavior
                      Source: SOA pdf.exe, 00000004.00000002.629722224.0000000001280000.00000002.00020000.sdmp, hgvQCmQ.exe, 0000001A.00000002.628148405.00000000014C0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: SOA pdf.exe, 00000004.00000002.629722224.0000000001280000.00000002.00020000.sdmp, hgvQCmQ.exe, 0000001A.00000002.628148405.00000000014C0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: SOA pdf.exe, 00000004.00000002.629722224.0000000001280000.00000002.00020000.sdmp, hgvQCmQ.exe, 0000001A.00000002.628148405.00000000014C0000.00000002.00020000.sdmpBinary or memory string: &Program Manager
                      Source: SOA pdf.exe, 00000004.00000002.629722224.0000000001280000.00000002.00020000.sdmp, hgvQCmQ.exe, 0000001A.00000002.628148405.00000000014C0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Users\user\Desktop\SOA pdf.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SOA pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.