Play interactive tour

Edit tour

Windows Analysis Report nxHHI8WXqt.exe

Overview

General Information

Sample Name:	nxHHI8WXqt.exe
Analysis ID:	528801
MD5:	f65b0793251364c03d06e8e7134fc21b
SHA1:	7bc80e89bbc7c10b974462e748849f9056d20d4a
SHA256:	a031918e001745c0f07d5d0ac118a0bfeb946236033e20fa1b16e0d54ee7bcb8
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Sigma detected: Suspicius Add Task From User AppData Temp

.NET source code contains potential unpacker

Sigma detected: Powershell Defender Exclusion

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

nxHHI8WXqt.exe (PID: 5860 cmdline: "C:\Users\user\Desktop\nxHHI8WXqt.exe" MD5: F65B0793251364C03D06E8E7134FC21B)

powershell.exe (PID: 6460 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6552 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nxHHI8WXqt.exe (PID: 6728 cmdline: C:\Users\user\Desktop\nxHHI8WXqt.exe MD5: F65B0793251364C03D06E8E7134FC21B)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "dubai@skycomex.com", "Password": "@EHbqYU1", "Host": "us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: nxHHI8WXqt.exe PID: 5860	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nxHHI8WXqt.exe PID: 5860	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nxHHI8WXqt.exe PID: 6728	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nxHHI8WXqt.exe PID: 6728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
18.0.nxHHI8WXqt.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.4255658.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.4255658.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.2.nxHHI8WXqt.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.nxHHI8WXqt.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.0.nxHHI8WXqt.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.3188dec.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.nxHHI8WXqt.exe.421f438.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.421f438.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 16 entries

Sigma Overview

System Summary:

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\nxHHI8WXqt.exe" , ParentImage: C:\Users\user\Desktop\nxHHI8WXqt.exe, ParentProcessId: 5860, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp, ProcessId: 6552

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nxHHI8WXqt.exe" , ParentImage: C:\Users\user\Desktop\nxHHI8WXqt.exe, ParentProcessId: 5860, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, ProcessId: 6460

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\nxHHI8WXqt.exe" , ParentImage: C:\Users\user\Desktop\nxHHI8WXqt.exe, ParentProcessId: 5860, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe, ProcessId: 6460

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132823724608924618.6460.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "dubai@skycomex.com", "Password": "@EHbqYU1", "Host": "us2.smtp.mailhostbox.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: nxHHI8WXqt.exe	Virustotal: Detection: 26%			Perma Link
Source: nxHHI8WXqt.exe	ReversingLabs: Detection: 25%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\SzfukVRF.exe

ReversingLabs: Detection: 25%

Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8

Source: nxHHI8WXqt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: nxHHI8WXqt.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Joe Sandbox View

IP Address: 208.91.198.143 208.91.198.143

Source: global traffic

TCP traffic: 192.168.2.3:49745 -> 208.91.198.143:587

Source: global traffic

TCP traffic: 192.168.2.3:49745 -> 208.91.198.143:587

Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: http://PClGeN.com
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: nxHHI8WXqt.exe, 00000012.00000002.559071890.00000000032A7000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: nxHHI8WXqt.exe, 00000012.00000002.559001330.0000000003270000.00000004.00000001.sdmp	String found in binary or memory: https://uvZLQjYprvsPcwavb.net
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: https://uvZLQjYprvsPcwavb.net4
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs	Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs	Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs	Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs	Large array initialization: .cctor: array initializer size 12035

Source: nxHHI8WXqt.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_015A8250	3_2_015A8250
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_015AD2E8	3_2_015AD2E8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_05865AA0	3_2_05865AA0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_05865AB0	3_2_05865AB0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_01144920	18_2_01144920
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_01143E6C	18_2_01143E6C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_01144912	18_2_01144912
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_011455F0	18_2_011455F0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AE6C0	18_2_013AE6C0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013A68F8	18_2_013A68F8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013A5B98	18_2_013A5B98
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AF160	18_2_013AF160
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AB190	18_2_013AB190
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_01441608	18_2_01441608
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_06156DA0	18_2_06156DA0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_061570E8	18_2_061570E8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_06159978	18_2_06159978
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_061579B8	18_2_061579B8

Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.310350535.00000000064E0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.304084320.0000000000D8E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.310033177.0000000006160000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameInnerException.dll" vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll@ vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000000.298656476.0000000000ABE000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000002.554056761.000000000116A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe	Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\SzfukVRF.exe A031918E001745C0F07D5D0AC118A0BFEB946236033E20FA1B16E0D54EE7BCB8

Source: nxHHI8WXqt.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SzfukVRF.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: nxHHI8WXqt.exe	Virustotal: Detection: 26%
Source: nxHHI8WXqt.exe	ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File read: C:\Users\user\Desktop\nxHHI8WXqt.exe:Zone.Identifier

Jump to behavior

Source: nxHHI8WXqt.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe "C:\Users\user\Desktop\nxHHI8WXqt.exe"
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe	Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File created: C:\Users\user\AppData\Roaming\SzfukVRF.exe

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/8@1/1

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_01
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Mutant created: \Sessions\1\BaseNamedObjects\hFVAGeNDDuOIYKYzrWNabcGxrk
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: nxHHI8WXqt.exe	String found in binary or memory: /DriveIn;component/views/addbook.xaml
Source: nxHHI8WXqt.exe	String found in binary or memory: views/addcustomer.baml
Source: nxHHI8WXqt.exe	String found in binary or memory: views/addbook.baml
Source: nxHHI8WXqt.exe	String found in binary or memory: /DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe	String found in binary or memory: /DriveIn;component/views/addbook.xaml
Source: nxHHI8WXqt.exe	String found in binary or memory: views/addbook.baml
Source: nxHHI8WXqt.exe	String found in binary or memory: views/addcustomer.baml
Source: nxHHI8WXqt.exe	String found in binary or memory: /DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe	String found in binary or memory: K/DriveIn;component/views/addbook.xamla/DriveIn;component/views/borrowfrombookview.xamlW/DriveIn;component/views/borrowingview.xamlQ/DriveIn;component/views/changebook.xamlY/DriveIn;component/views/changecustomer.xamlU/DriveIn;component/views/customerview.xamlY/DriveIn;component/views/deletecustomer.xamlO/DriveIn;component/views/errorview.xamlS/DriveIn;component/views/smallextras.xamlS/DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe	String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml

Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: nxHHI8WXqt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: nxHHI8WXqt.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: nxHHI8WXqt.exe, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: SzfukVRF.exe.3.dr, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.nxHHI8WXqt.exe.d10000.0.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.nxHHI8WXqt.exe.d10000.0.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.nxHHI8WXqt.exe.a40000.1.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.11.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.2.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.9.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.1.unpack, Biblan/Views/MainWindow.cs	.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_00D19347 push ds; ret	3_2_00D1934C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_00D192F5 push ds; ret	3_2_00D19340
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_00D19361 push ds; retf	3_2_00D19364
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_05866511 push esp; ret	3_2_0586651D
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_05866578 pushad ; ret	3_2_05866585
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 3_2_058656E0 push esp; iretd	3_2_058656E9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_00A49361 push ds; retf	18_2_00A49364
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_00A492F5 push ds; ret	18_2_00A49340
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_00A49347 push ds; ret	18_2_00A4934C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD51A push cs; iretd	18_2_013AD5A1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD64E pushad ; iretd	18_2_013AD651
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD6E6 pushad ; iretd	18_2_013AD6E9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD6DE pushad ; iretd	18_2_013AD6E1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD6D6 pushad ; iretd	18_2_013AD6D9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Code function: 18_2_013AD6CE pushad ; iretd	18_2_013AD6D1

Source: initial sample	Static PE information: section name: .text entropy: 7.88557099769
Source: initial sample	Static PE information: section name: .text entropy: 7.88557099769

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

File created: C:\Users\user\AppData\Roaming\SzfukVRF.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.3188dec.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5180	Thread sleep count: 3929 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239837s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239710s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5180	Thread sleep count: 4148 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5948	Thread sleep time: -30128s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239584s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239245s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -239109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238996s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238711s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238182s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -238046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -237031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236262s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -236046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -235687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -235141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -235009s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234885s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234306s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234185s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -234078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -233951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -233843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -233734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -233625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -233437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -232437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -231797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -231312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848	Thread sleep time: -231202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6724	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7092	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7096	Thread sleep count: 1245 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7096	Thread sleep count: 8607 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239837	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239710	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239584	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239468	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239358	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239245	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239109	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238711	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238594	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238312	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238182	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238046	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237937	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237812	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237250	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237140	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237031	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236922	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236811	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236703	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236593	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236484	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236373	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236262	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236156	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236046	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235687	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235141	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235009	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234885	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234750	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234639	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234531	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234420	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234306	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234185	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234078	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233951	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233843	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233734	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233625	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 232437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231797	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231312	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231202	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Window / User API: threadDelayed 3929	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Window / User API: threadDelayed 4148	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6149	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2154	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Window / User API: threadDelayed 1245	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Window / User API: threadDelayed 8607	Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239837	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239710	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 30128	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239584	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239468	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239358	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239245	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 239109	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238996	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238711	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238594	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238312	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238182	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 238046	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237937	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237812	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237703	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237250	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237140	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 237031	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236922	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236811	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236703	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236593	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236484	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236373	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236262	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236156	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 236046	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235687	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235141	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 235009	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234885	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234750	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234639	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234531	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234420	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234306	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234185	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 234078	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233951	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233843	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233734	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233625	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 233437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 232437	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231797	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231312	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 231202	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: nxHHI8WXqt.exe, 00000012.00000002.554939099.0000000001201000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Code function: 18_2_013A0A70 LdrInitializeThunk,KiUserExceptionDispatcher,KiUserExceptionDispatcher,

18_2_013A0A70

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe			Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe	Jump to behavior

Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Users\user\Desktop\nxHHI8WXqt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Users\user\Desktop\nxHHI8WXqt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Code function: 18_2_061553AC GetUserNameW,

18_2_061553AC

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.4255658.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.421f438.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.4255658.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.421f438.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools11	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery114	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing13	NTDS	Security Software Discovery311	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion131	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
nxHHI8WXqt.exe	27%	Virustotal		Browse
nxHHI8WXqt.exe	25%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\SzfukVRF.exe	25%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Unpacked PE Files

Source	Detection	Scanner	Label	Download
18.2.nxHHI8WXqt.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.0.nxHHI8WXqt.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.0.nxHHI8WXqt.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.0.nxHHI8WXqt.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.0.nxHHI8WXqt.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.0.nxHHI8WXqt.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://PClGeN.com	0%	Avira URL Cloud	safe
https://uvZLQjYprvsPcwavb.net4	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://uvZLQjYprvsPcwavb.net	0%	Avira URL Cloud	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org%GETMozilla/5.0	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://DynDns.comDynDNS	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://PClGeN.com	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	nxHHI8WXqt.exe, 00000012.00000002.559071890.00000000032A7000.00000004.00000001.sdmp	false		high
https://uvZLQjYprvsPcwavb.net4	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://uvZLQjYprvsPcwavb.net	nxHHI8WXqt.exe, 00000012.00000002.559001330.0000000003270000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%$	nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528801
Start date:	25.11.2021
Start time:	19:53:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	nxHHI8WXqt.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/8@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 120 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.107.5.88, 20.54.110.249 Excluded domains from analysis (whitelisted): www.bing.com, client-office365-tas.msedge.net, afdo-tas-offload.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, e-0009.e-msedge.net, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, mscrl.microsoft.com, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, cdn.onenote.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:54:17	API Interceptor	803x Sleep call for process: nxHHI8WXqt.exe modified
19:54:23	API Interceptor	44x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
208.91.198.143	PAGO DEL SALDO.doc	Get hash	malicious	Browse
	MT_1O1_SWIFt.doc	Get hash	malicious	Browse
	Reconfirm The Details.doc	Get hash	malicious	Browse
	Document.exe	Get hash	malicious	Browse
	MT_101_SWIFT.doc	Get hash	malicious	Browse
	Purchase Order PO#7701.exe	Get hash	malicious	Browse
	TNT E-Invoice No 11073490.exe	Get hash	malicious	Browse
	E invoice.exe	Get hash	malicious	Browse
	UY2021 Ta-Ho Maritime Schedule.exe	Get hash	malicious	Browse
	PNkBekAKOeQD1Jj.exe	Get hash	malicious	Browse
	PRESUPUESTO.xlsx	Get hash	malicious	Browse
	DHL Documentos de envio originales.exe	Get hash	malicious	Browse
	XSsBxQH419.exe	Get hash	malicious	Browse
	devis.xlsx	Get hash	malicious	Browse
	Quotation- 306013SQ.exe	Get hash	malicious	Browse
	PO 4601056018.exe	Get hash	malicious	Browse
	Purchase Order Vale-60,000MT.exe	Get hash	malicious	Browse
	BOQ 11745692.exe	Get hash	malicious	Browse
	dhl_doc9548255382.exe	Get hash	malicious	Browse
	ADYP_210913_100641_PAGOS_005539.xlsx	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	PAGO DEL SALDO.doc	Get hash	malicious	Browse	208.91.198.143
	MT_1O1_SWIFt.doc	Get hash	malicious	Browse	208.91.199.224
	Reconfirm The Details.doc	Get hash	malicious	Browse	208.91.199.224
	Document.exe	Get hash	malicious	Browse	208.91.198.143
	MT_101_SWIFT.doc	Get hash	malicious	Browse	208.91.199.225
	ORDER INQUIRY-PVP-SP-2021-58.exe	Get hash	malicious	Browse	208.91.199.224
	DOC221121.exe	Get hash	malicious	Browse	208.91.199.224
	Swift_HSBC_0099087645 xOJ4XUjdMZ40k5Hpdf.exe	Get hash	malicious	Browse	208.91.199.225
	Swift_HSBC_0099087645PDF.exe	Get hash	malicious	Browse	208.91.199.225
	P0_636732672772_RFQ.exe	Get hash	malicious	Browse	208.91.199.225
	rTyPU1zmY5PsyNl.exe	Get hash	malicious	Browse	208.91.199.223
	DOCUMENTS.exe	Get hash	malicious	Browse	208.91.199.223
	Purchase Order PO#7701.exe	Get hash	malicious	Browse	208.91.198.143
	STATEMENT OF ACCOUNT.xlsx	Get hash	malicious	Browse	208.91.199.225
	XsFFv27rls.exe	Get hash	malicious	Browse	208.91.199.225
	TransactionSummary_22-11-2021.exe	Get hash	malicious	Browse	208.91.199.225
	TNT E-Invoice No 11073490.exe	Get hash	malicious	Browse	208.91.198.143
	E invoice.exe	Get hash	malicious	Browse	208.91.198.143
	TOP QUOTATION RFQ 2021.exe	Get hash	malicious	Browse	208.91.199.223
	(KOREA SHIPPING - KLCSM).exe	Get hash	malicious	Browse	208.91.199.224

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	PAGO DEL SALDO.doc	Get hash	malicious	Browse	208.91.199.224
	MT_1O1_SWIFt.doc	Get hash	malicious	Browse	208.91.199.224
	Reconfirm The Details.doc	Get hash	malicious	Browse	208.91.199.224
	Document.exe	Get hash	malicious	Browse	208.91.199.224
	Swift Copy TT.doc	Get hash	malicious	Browse	207.174.212.140
	MT_101_SWIFT.doc	Get hash	malicious	Browse	208.91.199.224
	ORDER INQUIRY-PVP-SP-2021-58.exe	Get hash	malicious	Browse	208.91.199.224
	DOC221121.exe	Get hash	malicious	Browse	208.91.199.224
	Swift_HSBC_0099087645PDF.exe	Get hash	malicious	Browse	208.91.199.225
	P0_636732672772_RFQ.exe	Get hash	malicious	Browse	208.91.199.225
	DOCUMENTS.exe	Get hash	malicious	Browse	208.91.199.223
	Activation Online Mail.htm	Get hash	malicious	Browse	103.50.163.110
	Purchase Order PO#7701.exe	Get hash	malicious	Browse	208.91.198.143
	STATEMENT OF ACCOUNT.xlsx	Get hash	malicious	Browse	208.91.199.225
	XsFFv27rls.exe	Get hash	malicious	Browse	208.91.199.225
	TNT E-Invoice No 11073490.exe	Get hash	malicious	Browse	208.91.199.225
	SWIFT COPY.exe	Get hash	malicious	Browse	199.79.62.99
	E invoice.exe	Get hash	malicious	Browse	208.91.199.225
	TOP QUOTATION RFQ 2021.exe	Get hash	malicious	Browse	208.91.199.224
	TOwYernH3DhfPER.exe	Get hash	malicious	Browse	208.91.199.181

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\SzfukVRF.exe	PAGO DEL SALDO.doc	Get hash	malicious	Browse
C:\Users\user\AppData\Roaming\SzfukVRF.exe	MT_1O1_SWIFt.doc	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nxHHI8WXqt.exe.log Download File
Process:	C:\Users\user\Desktop\nxHHI8WXqt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2239
Entropy (8bit):	5.354287817410997
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIW7HKjntHoxHhAHKzvr1qHXHK2HKgmHKovjHKs:iqXeqm00YqhQnouRqjntIxHeqzTw3q2W
MD5:	913D1EEA179415C6D08FB255AE42B99D
SHA1:	E994C612C0596994AAE55FBCE35B7A4FBE312FD7
SHA-256:	473B4000084ACF4C7D701CE72EBF71BD304054231B3BDF7CAF49898A1FDA13D0
SHA-512:	768045C288CEEE8FE1A099FC8CEA713B685F6ED3FD8BFA1C8E64CA09F7AF9FEBEA90F5277B28444AFF8F2AC7CD857DFCDF7D3A98CD86288925DB7A4A42346185
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22380
Entropy (8bit):	5.602880384397681
Encrypted:	false
SSDEEP:	384:gtCDmkG5FhnBaq8I3RYS0n0jultI277Y9gtSJ3x+T1MarZlbAV76eajtwaZBDI+a:2DhnBx8IuT0CltZftc0CSfw2eaVg
MD5:	6E5AA2B59FB30334DF2D79A38145AF66
SHA1:	40E37B125CB865884CD3E83EBB2EBE368D0BB9BB
SHA-256:	AB1905EC107D69521C6D349A4937527CADFFC599A39DED4EE5A5E117F4071D79
SHA-512:	7030BF251BF02F6FB17BE0CB45357364F1D7B650C628750E33E116E2AE50F90B07F5228C24283743D203F99B12EC0929390137FECB1117C3956770DB0B3408AA
Malicious:	false
Reputation:	low
Preview:	@...e...................h.................I..........@..........H...............<@.^.L."My...:P..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lwqp4ijl.fo4.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u4tbugmi.jyn.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp Download File
Process:	C:\Users\user\Desktop\nxHHI8WXqt.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.151890175604769
Encrypted:	false
SSDEEP:	24:2di4+S2qh/Q1K1y1mokUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt5xvn:cge4MYrFdOFzOzN33ODOiDdKrsuTvv
MD5:	D286D620E2CCCEDAE1239D3C2CE20B8C
SHA1:	6B470B148C7765CFB9215E651B0E515E4F51362F
SHA-256:	AE83FF0BA1D10EE2F0FF8341DD2B11BE763D7FA938DD61715E46FF08D83D9ACA
SHA-512:	762E66A5CB6FF8958DBD9B88853693624725E0394590F0FA50173A2DF17588241CC148F99444B1FB8D0F6246B2AA97C39F22BFF43F0D64C141C477A7621D0334
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <

C:\Users\user\AppData\Roaming\SzfukVRF.exe Download File
Process:	C:\Users\user\Desktop\nxHHI8WXqt.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	504832
Entropy (8bit):	7.875034070984988
Encrypted:	false
SSDEEP:	12288:+v5E70ZixBFm0hDKr62YWLJp7WtXpcCAVS4EzOnsQ7b51:+vG70Zi1hy6O+LAVS4C
MD5:	F65B0793251364C03D06E8E7134FC21B
SHA1:	7BC80E89BBC7C10B974462E748849F9056D20D4A
SHA-256:	A031918E001745C0F07D5D0AC118A0BFEB946236033E20FA1B16E0D54EE7BCB8
SHA-512:	BAC2E15EAFEFF6708D67A224B96FBC62F062A6029D7E5DFCB773C2B07AAC4C01F910724192A6294DA3456B50E016F5A9859E9DD6EA18C2C51F02377AFBA3CB82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Joe Sandbox View:	Filename: PAGO DEL SALDO.doc, Detection: malicious, Browse Filename: MT_1O1_SWIFt.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.a..............0.................. ........@.. ....................... ............@.................................\|...O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........e...t..........\... .............................................{ .....{!.....{".....{#.....($.....} .....}!.....}"......}#.......0..s........u........f.,`(%....{ ....{ ...o&...,H('....{!....{!...o(...,0()....{"....{"...o...,.(+....{#....{#...o,...+..+....0..b....... .@d )UU.Z(%....{ ...o-...X )UU.Z('....{!...o....X )UU.Z()....{"...o/...X )UU.Z(+....{#...o0...X...0...........r...p......%..{ ......%q.........-.&.+.......o1....%..{!......%q.........-.&.+.....

C:\Users\user\AppData\Roaming\SzfukVRF.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\nxHHI8WXqt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\20211125\PowerShell_transcript.302494.M+vU4FE1.20211125195422.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5781
Entropy (8bit):	5.41314189541502
Encrypted:	false
SSDEEP:	96:BZuhAZNjqDo1ZtZthAZNjqDo1ZVEecjZKhAZNjqDo1ZzFMMMZj:c
MD5:	CAEADA81F2A001ED83A0883F818406CA
SHA1:	859E6592F3CE17B2BE44A982BA54E9B8FA221670
SHA-256:	42F4DF7A5DE48C0342CC19FE859D41717A4FE6B81A2DEDE517B166534FC05F6E
SHA-512:	25CC3085F3CE60ABD9AAF950F2D8A7D9A78281A8438F2B768A48351FEE115E46674B4B334EE094E3CB80064E40D04F598DB6DA31E77DDCEEF19B9A9C7EB7D374
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211125195423..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 302494 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\SzfukVRF.exe..Process ID: 6460..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211125195423..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\SzfukVRF.exe..********************..Windows PowerShell transcript start..Start time: 20211125195833..Username: computer\user..RunAs User: computer\user..C

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.875034070984988
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	nxHHI8WXqt.exe
File size:	504832
MD5:	f65b0793251364c03d06e8e7134fc21b
SHA1:	7bc80e89bbc7c10b974462e748849f9056d20d4a
SHA256:	a031918e001745c0f07d5d0ac118a0bfeb946236033e20fa1b16e0d54ee7bcb8
SHA512:	bac2e15eafeff6708d67a224b96fbc62f062a6029d7e5dfcb773c2b07aac4c01f910724192a6294da3456b50e016f5a9859e9dd6ea18c2c51f02377afba3cb82
SSDEEP:	12288:+v5E70ZixBFm0hDKr62YWLJp7WtXpcCAVS4EzOnsQ7b51:+vG70Zi1hy6O+LAVS4C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.a..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x47c9ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x619F6AFA [Thu Nov 25 10:52:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [ebp+0800000Eh], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7c97c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7e000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7a9e4	0x7aa00	False	0.898564920999	data	7.88557099769	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x7e000	0x5bc	0x600	False	0.429036458333	data	4.13584862194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x7e090	0x32c	data
RT_MANIFEST	0x7e3cc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Rogers Peet
Assembly Version	8.0.6.0
InternalName	DriveIn.exe
FileVersion	5.6.0.0
CompanyName	Rogers Peet
LegalTrademarks
Comments
ProductName	Biblan
ProductVersion	5.6.0.0
FileDescription	Biblan
OriginalFilename	DriveIn.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 19:56:05.852224112 CET	49745	587	192.168.2.3	208.91.198.143
Nov 25, 2021 19:56:08.860101938 CET	49745	587	192.168.2.3	208.91.198.143
Nov 25, 2021 19:56:14.875684977 CET	49745	587	192.168.2.3	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 19:56:05.620966911 CET	54154	53	192.168.2.3	8.8.8.8
Nov 25, 2021 19:56:05.667192936 CET	53	54154	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 25, 2021 19:56:05.620966911 CET	192.168.2.3	8.8.8.8	0xa0c3	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 25, 2021 19:56:05.667192936 CET	8.8.8.8	192.168.2.3	0xa0c3	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)
Nov 25, 2021 19:56:05.667192936 CET	8.8.8.8	192.168.2.3	0xa0c3	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)
Nov 25, 2021 19:56:05.667192936 CET	8.8.8.8	192.168.2.3	0xa0c3	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)
Nov 25, 2021 19:56:05.667192936 CET	8.8.8.8	192.168.2.3	0xa0c3	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: nxHHI8WXqt.exe PID: 5860 Parent PID: 5752

General

Start time:	19:54:15
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\nxHHI8WXqt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nxHHI8WXqt.exe"
Imagebase:	0xd10000
File size:	504832 bytes
MD5 hash:	F65B0793251364C03D06E8E7134FC21B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6460 Parent PID: 5860

General

Start time:	19:54:20
Start date:	25/11/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe
Imagebase:	0x1350000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6532 Parent PID: 6460

General

Start time:	19:54:21
Start date:	25/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 6552 Parent PID: 5860

General

Start time:	19:54:21
Start date:	25/11/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp
Imagebase:	0x840000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6676 Parent PID: 6552

General

Start time:	19:54:22
Start date:	25/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: nxHHI8WXqt.exe PID: 6728 Parent PID: 5860

General

Start time:	19:54:23
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\nxHHI8WXqt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\nxHHI8WXqt.exe
Imagebase:	0xa40000
File size:	504832 bytes
MD5 hash:	F65B0793251364C03D06E8E7134FC21B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: nxHHI8WXqt.exe PID: 5860 Parent PID: 5752 nxHHI8WXqt.exeCOMMON

Executed Functions

Function 015AD2E8, Relevance: 2.5, Strings: 1, Instructions: 1297COMMON

Download Yara Rule

Strings

d, xrefs: 015AD80A

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 73ad148868d186c00b19dd53a437bffc84ca300d4bcffc812a6692d44313d24f
Instruction ID: b2d188cac9bd26f12bb9fc892563204dc3c9a19c8c1023d131bfb74f4bac7dda
Opcode Fuzzy Hash: 73ad148868d186c00b19dd53a437bffc84ca300d4bcffc812a6692d44313d24f
Instruction Fuzzy Hash: C8C23874A40205CFDB18DF64D455AAE7BF2FB89344F5084A9D90A9B361EB34ED82CF81

Uniqueness

Uniqueness Score: -1.00%

Function 015A8250, Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839f23d6b07b28ce6b3b7f3788deeecae493b23aa152f9f22dc5cf3bbcaed489
Instruction ID: e101ea1637957974cf7f597a7faab826deeb257a1f9c40dab95102ac8ba5f5ec
Opcode Fuzzy Hash: 839f23d6b07b28ce6b3b7f3788deeecae493b23aa152f9f22dc5cf3bbcaed489
Instruction Fuzzy Hash: 01020231A40215CFDF25DF78C5546BE7BE2BF88216F898825E8569F291DB38DC41CB82

Uniqueness

Uniqueness Score: -1.00%

Function 015A4497, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 015A4522

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 80c13b82d350068b0d2a89a38bc7419e272629b9cffccc7720964ad31f2b12b1
Instruction ID: 1b68b5c88265a5e1544b5d9f0dce06944f15d5dac272d085cf2eb7b01572a209
Opcode Fuzzy Hash: 80c13b82d350068b0d2a89a38bc7419e272629b9cffccc7720964ad31f2b12b1
Instruction Fuzzy Hash: 342188B19003458FCB50CFAAD54939EBFF4FB49318F548869D444A6641DB7AA540CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015A4747, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 015A47CD

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d396397e8505976f6eadbd8484527bce527fa6b3f972fe4225aa118a1652fbf5
Instruction ID: 180389ae27c81bace8f8df0cfc727b8ab0bfb95b4870bbb131eb89f701aea9a1
Opcode Fuzzy Hash: d396397e8505976f6eadbd8484527bce527fa6b3f972fe4225aa118a1652fbf5
Instruction Fuzzy Hash: 9421AEB98103858FCB10CFE9D50939EBFF4FB09314F58882AD454AB642CBB85505CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015A44A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 015A4522

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d88e4bcbeaacb004f3ded27e7339bc72e6156211c8d16af0ae216ef0df3480e6
Instruction ID: 8c6c458dad2de3dac29e8681047233cba558e8b307fb84e629c30f6e66facebe
Opcode Fuzzy Hash: d88e4bcbeaacb004f3ded27e7339bc72e6156211c8d16af0ae216ef0df3480e6
Instruction Fuzzy Hash: 4D1197B0900249CFCB50CFAAE50979EBFF4FB49314F148869D404A7601CB7AA540CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015A4758, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 015A47CD

Memory Dump Source

Source File: 00000003.00000002.304808901.00000000015A0000.00000040.00000001.sdmp, Offset: 015A0000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 897479ff917b41aa5b70e025a854392a213453666553995f107409e559a84924
Instruction ID: c4bbf65d721eafa75a361cbd97b8e6cfb505195c1256986059d0f1e0f114fc28
Opcode Fuzzy Hash: 897479ff917b41aa5b70e025a854392a213453666553995f107409e559a84924
Instruction Fuzzy Hash: 3D117CB9810389CFCB60DF99D50979EBFF8FB08314F548829D404A7641CBB8A505CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05866BC8, Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

=", xrefs: 05866F56

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID: ="
API String ID: 0-1535570552
Opcode ID: aef8bb5d97d07554353e50c28cf4e5c5e557d56d717cb0d9d54b26a3e6fa7baf
Instruction ID: 7e2f9193e9cc6c896a465109e27472bae155d9e5223593d100273619bc17e013
Opcode Fuzzy Hash: aef8bb5d97d07554353e50c28cf4e5c5e557d56d717cb0d9d54b26a3e6fa7baf
Instruction Fuzzy Hash: 304103367182948FDB059B70981D96D3FA2EF86311B0484AAF843CB2D2EF75DC40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05866F7D, Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

=", xrefs: 05866F56

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID: ="
API String ID: 0-1535570552
Opcode ID: de5012319d2fef470a8ddf122b73d0426959fab3564b49c24b6d10376087d717
Instruction ID: b3cbc76a0d39a43653f749d37aab438f961ab0f0190f70bac9823baacf22bf52
Opcode Fuzzy Hash: de5012319d2fef470a8ddf122b73d0426959fab3564b49c24b6d10376087d717
Instruction Fuzzy Hash: 92016771608497DAC724CB6EE8512BAB3B2FB44394F008A26F957C6184F735ED51C661

Uniqueness

Uniqueness Score: -1.00%

Function 0586F7B8, Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a3767948081266a7f1872a9bb639a4c12e3816e7df99074a5970dc01676dec
Instruction ID: 460c3b8ecd8719546e72ddab281ed0294edb27c90339a130bd5f16e423e2c324
Opcode Fuzzy Hash: f6a3767948081266a7f1872a9bb639a4c12e3816e7df99074a5970dc01676dec
Instruction Fuzzy Hash: AAA16931B001199FDB14DFA4E854AAE77A7FF88348F148428EA06DB394DB34DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05867E87, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a07b300bcaf5ece27fcf78c6ddf32b77828c3b0c11645e718b90f50c31209d4
Instruction ID: b8801af3655b7681417c2aec9a11dd5ae3bd1dc4b2295f76bafbc26bdc616b9d
Opcode Fuzzy Hash: 3a07b300bcaf5ece27fcf78c6ddf32b77828c3b0c11645e718b90f50c31209d4
Instruction Fuzzy Hash: 2F81BE70A042148FC704DBA4C958AAE7BF6FF85308F1588ADD54A9F3A5DB35CD09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05867C21, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bbfd5b62a8ec49abfd32d11a6f89db46fad871ce2576f8b2bfb020cd135d7e4
Instruction ID: 56d7f1f0524087d02d06d7dcc72537921b892f3287c16c60d3e8db5c8b17ffc2
Opcode Fuzzy Hash: 5bbfd5b62a8ec49abfd32d11a6f89db46fad871ce2576f8b2bfb020cd135d7e4
Instruction Fuzzy Hash: 6251EF31B006248FE714DB7888587BEB6A2EF89758F108879E919DF394DF349C0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 0586F5B8, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b23e4fcdc6c60636aa4e8be020120567706559173f2866eea652f6a4222e279
Instruction ID: d27cc95f7d617ef342f9e3bedac406ff1bb680c0ee1a1c454759f5d1f52a3361
Opcode Fuzzy Hash: 7b23e4fcdc6c60636aa4e8be020120567706559173f2866eea652f6a4222e279
Instruction Fuzzy Hash: E3510431B042468FCB14DFB8E98896F7BB6BF85604F158469DA05D7269EB30EC44C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0586F190, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eee5ad831afc9d3b70956c60891bf53771211f43f2ba68b9a6d6b1605fa924
Instruction ID: 2c04fc24dd500fd59b34d866af2c9b3bb245213165e9074388b115e9923a30de
Opcode Fuzzy Hash: 91eee5ad831afc9d3b70956c60891bf53771211f43f2ba68b9a6d6b1605fa924
Instruction Fuzzy Hash: 0E618B35B101189FCB14CFA8E558AAE7BB6BF88714F154069EA02EB394DB31DC45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 058656EB, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4d04074c2d1de12f876174f80d787c807c378f004e938168fc5b101f8d0db2
Instruction ID: 5f4f6a6f9bcfef3215e5bdc77cd19a15cf375498687cba886dcc9fd67fa16b78
Opcode Fuzzy Hash: cf4d04074c2d1de12f876174f80d787c807c378f004e938168fc5b101f8d0db2
Instruction Fuzzy Hash: 42712A35A00619DFDB14DFA8C494A9DBBF2FF88314F108159E90AEB360DB71AD85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0586933E, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561ec5b5c0b25b31212977b16345534170983c978cba6e757d3c9446f126c344
Instruction ID: 39a353dece057d5b196bb211745a988e8172a6dfc3af941a36a5d0b0b653709f
Opcode Fuzzy Hash: 561ec5b5c0b25b31212977b16345534170983c978cba6e757d3c9446f126c344
Instruction Fuzzy Hash: 17616B70A046598FCB00CBA9C6459BDBBF1FF48708F1496AAE859DB2D1E334EC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05868918, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3e755bc10d56d9b41df6d9fcd4d286a40ecf6495aca02896bcfe973aaf316e
Instruction ID: f7efff4c426b185053b30817559362f7149ebfbdb5875a183c9f7697151e4ad0
Opcode Fuzzy Hash: ad3e755bc10d56d9b41df6d9fcd4d286a40ecf6495aca02896bcfe973aaf316e
Instruction Fuzzy Hash: CE518E71B00229DFEB04CB94C9457AEBBF3FB89314F108539E909AB281DB349D46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 058618A4, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a817a15398c5b69e280076cb8ab11beb303e198a2b3b12bfe94c5257399ee0df
Instruction ID: 81aa0c43b748b3f9488d17bd8f5a7bb0eabf0070c338d80b86e4d9fef2c9647e
Opcode Fuzzy Hash: a817a15398c5b69e280076cb8ab11beb303e198a2b3b12bfe94c5257399ee0df
Instruction Fuzzy Hash: 5451C035B002558FDB14DFB898988BEBBF6BFC52247148969E819D73A0DF309C068791

Uniqueness

Uniqueness Score: -1.00%

Function 05869B18, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db60413bf1f57cfc92fbaac4d3eab85ece0b242eb0a4a660fa280b664c5c9f96
Instruction ID: a59e974f44bebbcfc9127f908af8690462a3852a523aae4fe8a2e6c6f3ec0f05
Opcode Fuzzy Hash: db60413bf1f57cfc92fbaac4d3eab85ece0b242eb0a4a660fa280b664c5c9f96
Instruction Fuzzy Hash: 2A418E70A01618CFDB10CF69C9506AAFBF2FF48345F04856AE869EB291D338DC40DB95

Uniqueness

Uniqueness Score: -1.00%

Function 05864FB4, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b90562c34ceb33a62c2412cbbd74e6e6d520a2511f9b9a8452810d62ea64a3
Instruction ID: 764705f2dd7811af2b699297b6f943ea8a7575832d371881e6d03fefa01bc0b1
Opcode Fuzzy Hash: 24b90562c34ceb33a62c2412cbbd74e6e6d520a2511f9b9a8452810d62ea64a3
Instruction Fuzzy Hash: DB41D2B1D00249CFDB10CFA9C585ADEFBF5BF49304F648529D809AB210D775AA4ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 05861108, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4787a221f9c358281193075fa7d11d619bdbc6ea463f56e8727830f1f008bb
Instruction ID: 14f4567bd0757ee21f25bc4a518bd752baca721a879e4a60dab701934a8153e2
Opcode Fuzzy Hash: 1b4787a221f9c358281193075fa7d11d619bdbc6ea463f56e8727830f1f008bb
Instruction Fuzzy Hash: 41317C343406448FC700EF65D895D9AB7EAEFC4708B1889A9E2068F3B5DB71EC05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05869B08, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32125cd8749a0f87a5256a009769a5d88e3bc08f20dce420692630c49acbc9a
Instruction ID: 005447776506588099ab50e79aa5f3bd9ece9ed7737456bb5bc1a87b1737ca05
Opcode Fuzzy Hash: f32125cd8749a0f87a5256a009769a5d88e3bc08f20dce420692630c49acbc9a
Instruction Fuzzy Hash: 8A419E70A05628CFDB10CF68C9406AAFBF2FF48345F05856AE85AEB295D338DD40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05864FC0, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57328871c87f53527ecba6811899fa1a8922804b86da8c3e106420522b8354a5
Instruction ID: 2e57fea4806722639db9be922663f8cc08d0103649c62b7eee1764264b41e9db
Opcode Fuzzy Hash: 57328871c87f53527ecba6811899fa1a8922804b86da8c3e106420522b8354a5
Instruction Fuzzy Hash: 4741AFB1D00209DBDB20DFA9C585ACEFBB5BF48304F648529D909AB210D775AA4ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 05861118, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3308c0b971e6dc512523fde4fc9a3bd1d6cab45fbd0ae265b9aeb9d5f854d3
Instruction ID: 127853bfcd14939fd3c727df38d94ab141ed9838ad6498337fb246702b22a833
Opcode Fuzzy Hash: 2b3308c0b971e6dc512523fde4fc9a3bd1d6cab45fbd0ae265b9aeb9d5f854d3
Instruction Fuzzy Hash: 2D311D343406449FC714EF66D894D9AB7EAEFC4708B1489A9E20A8F3B4DB71EC058B94

Uniqueness

Uniqueness Score: -1.00%

Function 0586E840, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef803a91aaab42575464c41b04dc9be99bceb72c2c88ab91a4af8ec74ffa7f0
Instruction ID: e809a942fd7fabc996b8b0f7aa65c2507a532249fa71d0b8a12becbd86e81440
Opcode Fuzzy Hash: 7ef803a91aaab42575464c41b04dc9be99bceb72c2c88ab91a4af8ec74ffa7f0
Instruction Fuzzy Hash: 90316C79A04119CBDF00CFAAD841AAFB7BAFF48304F104666ED25EB251C7749D40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05864758, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a534a7c9bbdf1fe927b838b848e8653e5e9d07ce7a349309e61233046f769b31
Instruction ID: 09cf42806907b83d8ca7301720079c4ad2ac634aa5f0346e781705a53ae25689
Opcode Fuzzy Hash: a534a7c9bbdf1fe927b838b848e8653e5e9d07ce7a349309e61233046f769b31
Instruction Fuzzy Hash: 08212775A043894FDF16DBB84CA46BE7FB6FF82120F19456AD851C7252EB309C09C762

Uniqueness

Uniqueness Score: -1.00%

Function 05869072, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e9b5eff9ee07ba80976649fc946526a4331732d6d54d01e80c14c1221debf7
Instruction ID: d362cbafc2535eb0072abb8b757c5252eed8f411323a9a389eb37f59c653f965
Opcode Fuzzy Hash: 92e9b5eff9ee07ba80976649fc946526a4331732d6d54d01e80c14c1221debf7
Instruction Fuzzy Hash: 75210570F0855A8BCB41CBA8C9403BEB7B6AF84314F148227FD65CA1D2C638CD968793

Uniqueness

Uniqueness Score: -1.00%

Function 0586E9A8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22421d9c052615eb55f3aca0a312bd604ff7858bab00f97f58fa3aebfe0350d
Instruction ID: a6a51b046c6cbaf0842b3784daaa0cd327fc672c74a6df6cae9e2ca592d3862a
Opcode Fuzzy Hash: b22421d9c052615eb55f3aca0a312bd604ff7858bab00f97f58fa3aebfe0350d
Instruction Fuzzy Hash: 95219234A04118AFEB54AB649C55BAE3BBBEF84350F108865EA06DB584DA345D0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 05864944, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a3d2220dba6f290a138c33c36fb4c6d14e9383d2a9bdb2a4cdd733b042ff52
Instruction ID: ee9491ee11da9a705da0e013cdf24291e14c5b7433d376906db36eb3fff2ee66
Opcode Fuzzy Hash: 67a3d2220dba6f290a138c33c36fb4c6d14e9383d2a9bdb2a4cdd733b042ff52
Instruction Fuzzy Hash: EF31EFB0D01218DFDB20CF99C585BDEBFF4AB09324F24855AE805B7260C7B45849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05864734, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c85eea12a494f4eacbc12e0378c8f32ecc115d7df5721fb7c37e54e1fd7ebde
Instruction ID: 791548b1ca1226696ac8daa5f5991fd6c05d481032efaf21058eb955b256b454
Opcode Fuzzy Hash: 1c85eea12a494f4eacbc12e0378c8f32ecc115d7df5721fb7c37e54e1fd7ebde
Instruction Fuzzy Hash: 2431E0B0D01218DFDB20CFD9C588BCEBBF4AB08314F64845AE905BB260C7B45C49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05864EAB, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250f612c88d50153d30642f7d4a06dbd05651bc0aff1d8c8c76841f80759a4e6
Instruction ID: c69c694bafcf3f3c1aac417cef60cffd3b9eed47273846093b434e6ff2df734e
Opcode Fuzzy Hash: 250f612c88d50153d30642f7d4a06dbd05651bc0aff1d8c8c76841f80759a4e6
Instruction Fuzzy Hash: 9E21D8757006058FCB14EB78C4589AE77F6EF85205F454829D606DB360EF74ED098B91

Uniqueness

Uniqueness Score: -1.00%

Function 05861897, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9520d973ace3b80034b801238ce4290456a1ec9637309f7422fac26dfd6b017f
Instruction ID: 3ee86018eee02f13c94c01f8ab3384fca31611b1b900971a2aef7e74b5037629
Opcode Fuzzy Hash: 9520d973ace3b80034b801238ce4290456a1ec9637309f7422fac26dfd6b017f
Instruction Fuzzy Hash: 9C11C175B002595B9B25EBA99C958BFBAFBFBC52203144929E815D3350EF309D0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 05861A90, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e17a1606ef588020ce3b599ceacf63641029af362ba2ffbf9b0515fbdccb4b
Instruction ID: c6bf36fa4be4c588692d217be63862fd854fe84ae00cc93e56600db406e5df70
Opcode Fuzzy Hash: 95e17a1606ef588020ce3b599ceacf63641029af362ba2ffbf9b0515fbdccb4b
Instruction Fuzzy Hash: BF114831B002598FCB54EBB899515FEB7F6AFC8254B104079C909EB244EF358E16CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05861080, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c26a3cdb13ffe03960947f877ee13dac9a0d36a355b0db014b870ae7fa9bf3
Instruction ID: dd2f4e7dc3717ff0ce4955183e1dda368623b45eca45be7a145f2ac6bab03c94
Opcode Fuzzy Hash: 75c26a3cdb13ffe03960947f877ee13dac9a0d36a355b0db014b870ae7fa9bf3
Instruction Fuzzy Hash: 8C01B9312047445BC714DF7AD85089ABBFADEC22543488EAED546CF212EE71AC0987E1

Uniqueness

Uniqueness Score: -1.00%

Function 05864740, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8b32a522f48418c6ab7d29bee434fb43b8d7ad53d5c43d6f02e7f270ff41a4
Instruction ID: 6c3abf917b1c7d154c2256cf2c57043a762dab9ffc33ece5fc225da4d0a41352
Opcode Fuzzy Hash: 6d8b32a522f48418c6ab7d29bee434fb43b8d7ad53d5c43d6f02e7f270ff41a4
Instruction Fuzzy Hash: 4A1103B59042488FCB20DF99D589BDEFBF8EB48324F14881AD959A7700C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 058655A0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e526198e8398467a0ceae71839165a70d0213ea05afcb7b7a737ac74325f98
Instruction ID: dbb108b18f412200b19ea652f65ceaa44573caf7f627252134cfefca92a5c3c1
Opcode Fuzzy Hash: 96e526198e8398467a0ceae71839165a70d0213ea05afcb7b7a737ac74325f98
Instruction Fuzzy Hash: A11118B5D002089FCB10DF99C545BDEFBF8EB48324F148419DA59A7740D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05867E00, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd4b0a1610080b10c3ff11604b1f45009961dec1371b540200f8c4ef748bc8a
Instruction ID: 513163b567d71c9dcf1a1d1154957c0a11b049965b68d213648bcc52f62a7505
Opcode Fuzzy Hash: 1cd4b0a1610080b10c3ff11604b1f45009961dec1371b540200f8c4ef748bc8a
Instruction Fuzzy Hash: 3C01D130300114AFEB08DA69D859A6A7BDAEBD8A58B504479F90ACB390DF75DD04C792

Uniqueness

Uniqueness Score: -1.00%

Function 05865488, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2558704c53e8cfb1d1ed1841e20b43ca087050fe40fc0b7333e411533910911
Instruction ID: df5c044ac3c0d4ab6211e51a8f2ec092531044c4d4b74985a228ade5fb9ec38e
Opcode Fuzzy Hash: e2558704c53e8cfb1d1ed1841e20b43ca087050fe40fc0b7333e411533910911
Instruction Fuzzy Hash: 33F0F6B27042601FD304C66ADC45D7B7BEDEB8A27578540BAF908DB351E9318C09C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 058665C9, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393d6ab3b452cfe3a33031a1ff467a2f22617a819d1ccb5b046686efc472dd75
Instruction ID: c5f140ae185b129e828852834b13ec32ba4fc3c8f4c5cdadbca7cd95774715c4
Opcode Fuzzy Hash: 393d6ab3b452cfe3a33031a1ff467a2f22617a819d1ccb5b046686efc472dd75
Instruction Fuzzy Hash: DF014470A042499FCB40DFA9D4449ADBBF4BF4A344F4486EAD808E7355EB309E40CF81

Uniqueness

Uniqueness Score: -1.00%

Function 058674F5, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8317ba725fe215d5a28cca5ee65a083540b6b9adec3a0d4f3f93e093f5547f9e
Instruction ID: 59038f33e7adb474891ea25ffe09bf0f7051cd68738043a0279bc80b8aca7e6d
Opcode Fuzzy Hash: 8317ba725fe215d5a28cca5ee65a083540b6b9adec3a0d4f3f93e093f5547f9e
Instruction Fuzzy Hash: 86011B20606691CFD7125B34C8596693BA2AF0621DF2881EAD495CE193D33D884ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05861090, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a8fe07fa58f5572353ecbfc1931a4ad6c4ea13d0491ee26c0688893afa21be
Instruction ID: b97cc8f8da5555c004439b29a56670d48f4359b1071ac29566c45dae631843cc
Opcode Fuzzy Hash: 97a8fe07fa58f5572353ecbfc1931a4ad6c4ea13d0491ee26c0688893afa21be
Instruction Fuzzy Hash: 8FF036312007495B8314DF5AD89088BB7EAEFD5254344CE6DD64B8B251DF71FD0947D1

Uniqueness

Uniqueness Score: -1.00%

Function 058653EC, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec20d89ce145aa281bdbd79f8f9792800f096cd3c62264478cccb52b7cd7f134
Instruction ID: f1f386ea0d359d7d0050d33588586b7f5a905d5037f3995e54eb34d62ef4aaac
Opcode Fuzzy Hash: ec20d89ce145aa281bdbd79f8f9792800f096cd3c62264478cccb52b7cd7f134
Instruction Fuzzy Hash: 300108B0800219DFDB25CF6AC4086AE7AB1FB48311F608165E825EA290D7744E44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058653F8, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6417653f502f1a4d9a9a47d584b5b45feefdaea57809c17c35d0961348ca72
Instruction ID: f277c4fcfb73ec77bfd719d9c7de8e4d826f326f40a7415389ca183084a173e8
Opcode Fuzzy Hash: 0f6417653f502f1a4d9a9a47d584b5b45feefdaea57809c17c35d0961348ca72
Instruction Fuzzy Hash: 1801E8B0800219DFDB15CF6AC4083AEBAF1FF48351F508265E825EA290D7744A44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 05866511, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460421e06fef4bd4de3bac47cfb26439e4d63cc9a8a075e1b5025b4ec8bdb13e
Instruction ID: 6252baf88361e6724e5741aae783b47ebb627ac57a3d59cef2e5c3ddcb3ee7ca
Opcode Fuzzy Hash: 460421e06fef4bd4de3bac47cfb26439e4d63cc9a8a075e1b5025b4ec8bdb13e
Instruction Fuzzy Hash: B5F017B4D00208AFDB44DFA5E9057AEBBB9FB89300F1085AAD818B3344E7354B41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05866578, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d6c00eeaf7527f696141e58c5f08f46286fd40446c00d041ead98ec6081cc2
Instruction ID: 2fae1ef81e5adb786bb77bd732e38fe23e56c8f6d75b4f9a0079e62d6694fd12
Opcode Fuzzy Hash: 14d6c00eeaf7527f696141e58c5f08f46286fd40446c00d041ead98ec6081cc2
Instruction Fuzzy Hash: 9FF03AB4C082589FCB09DFB9D8095ADBBB4FB45304F4085EAD828E3345EB700A048F52

Uniqueness

Uniqueness Score: -1.00%

Function 058665D8, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb00cbf967250fde2d5adb0d2cd7cf1e939abad6706a4a3e977025aceefcf1d
Instruction ID: 194314f8b7ee1f41be3a39eb0cb2b65076c3dc885ad6fb916a00a273f22d88d2
Opcode Fuzzy Hash: afb00cbf967250fde2d5adb0d2cd7cf1e939abad6706a4a3e977025aceefcf1d
Instruction Fuzzy Hash: BC01B274900209EFCB40DFA9D484A9DBBF8FF48304F108AA9D914A7355E730AA80CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05865498, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da500eb325e6ba939b1226f739e42f62a101d0f391fb9a4635fdc3ca1710a1a
Instruction ID: 3d57f8d7ba40be0fd04e8fc4ffd3a43475e6d38690d1d1fbe98f9788c4865416
Opcode Fuzzy Hash: 0da500eb325e6ba939b1226f739e42f62a101d0f391fb9a4635fdc3ca1710a1a
Instruction Fuzzy Hash: 1EE0ED767041246F9314DAAEDC84C6BBBEEEBCD6B4355857AF90CC7320DA319C05C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 058665D6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af90bfec2a6b96628955893bb0e82ed9a3e265c9f396e9183792c4e4e1054a9
Instruction ID: 977f22e7632143b1c31fa6998f15702f6bc2a97ebcc58792b482f87b149938a2
Opcode Fuzzy Hash: 2af90bfec2a6b96628955893bb0e82ed9a3e265c9f396e9183792c4e4e1054a9
Instruction Fuzzy Hash: 6701B274900209DFCB40DFA8D584A9DBBF5FF48304F148AA9D818E7314D7309A80CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05866520, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991be1fef184b4c19ddce8f8f72ce1190484bc1b66c2ab854be265e996023bf9
Instruction ID: 68f9497cab0ee4e88b87c87f5607a83d3b1438fdd5716fb7d1300e77c1580213
Opcode Fuzzy Hash: 991be1fef184b4c19ddce8f8f72ce1190484bc1b66c2ab854be265e996023bf9
Instruction Fuzzy Hash: CDF034B4D00308EFCB44DFA9D9046AEBBB9FB89700F0081AAC814A3304EB305A41DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0586651E, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c492a1fa8bf4d1b59dd5ea53fb65f4c2bb7796a8cb33f9a78a67920de2b5768b
Instruction ID: 63bfc2a59d30b9f096d9a67d2288fa181e46bc018f6fec9da241df6132cfc34b
Opcode Fuzzy Hash: c492a1fa8bf4d1b59dd5ea53fb65f4c2bb7796a8cb33f9a78a67920de2b5768b
Instruction Fuzzy Hash: 52F0D4B4D00208EFCB44DFA5DA046AEBBB5FB89701F1095AAD818B3304E7354B51DF41

Uniqueness

Uniqueness Score: -1.00%

Function 0586E7E8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c472bc9599ee4c52bdc0b7933507ef305d8b18e2c1a4f3be7f3acaea2b74c446
Instruction ID: cb67835bba3a04d4f40360d8dd4f80ef0b18bfb46ddf3537bc89a59f32e53e69
Opcode Fuzzy Hash: c472bc9599ee4c52bdc0b7933507ef305d8b18e2c1a4f3be7f3acaea2b74c446
Instruction Fuzzy Hash: 55E0CD3138022037E60931559C1BFBB714FE7C0B90F14803AF5058F7C5CEE15D0A42A2

Uniqueness

Uniqueness Score: -1.00%

Function 05864A4F, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e6edfc35201a7dce24a04fcdc5edb6a3be475e6a2336518c398aec48ae423
Instruction ID: 8a62630f4d39ef375ee905997e3f1f05208eff1f3eacbe371932b57d86c5bf3f
Opcode Fuzzy Hash: d43e6edfc35201a7dce24a04fcdc5edb6a3be475e6a2336518c398aec48ae423
Instruction Fuzzy Hash: EFF0E53460514CEFCB00DF60D9408AD7B75EF4125971281E9DC08EB212DA326E0A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 05866588, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c183c687084819d755061873eaff5914cb95299fb8c6097a5ba5f6a0ffcb6502
Instruction ID: d47aeaeca0d04497b77ba537cbc6530d8821f05213130f91a2d95218a13dcff8
Opcode Fuzzy Hash: c183c687084819d755061873eaff5914cb95299fb8c6097a5ba5f6a0ffcb6502
Instruction Fuzzy Hash: 49E0C9B4D0821C9FDB44DFEAD8056ADBBF8FB44304F0085AA8818A3304EB705A458F41

Uniqueness

Uniqueness Score: -1.00%

Function 05866586, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd85cae0023e529ec31a575735fc3484ee5964b71098be25b34ab4d652ccd85b
Instruction ID: a904190904a16ac2f92f29bec91f61be4ea54d4c1eaa303773e50c14e44ce631
Opcode Fuzzy Hash: dd85cae0023e529ec31a575735fc3484ee5964b71098be25b34ab4d652ccd85b
Instruction Fuzzy Hash: 9FE0C2B4D082189FDB48DFEAD9056ADBBB5FB48304F0089AA8828E3704EB304A448F41

Uniqueness

Uniqueness Score: -1.00%

Function 05869948, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552f327bb2ede57e6e9a10400e195b100046acebe16d09003496aa036b852a7a
Instruction ID: 177cddb8781d564095a0fac645c3f1bf59b5fab8a350cefde50fb725b7b9fa1a
Opcode Fuzzy Hash: 552f327bb2ede57e6e9a10400e195b100046acebe16d09003496aa036b852a7a
Instruction Fuzzy Hash: C4E08C31A093808FC3578B38E4084523FF9EF8A66135504FFE586CF2B6DA249C01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05864A60, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88527878aebe6bf81599ddc2a3e91b1cebf57b97ee23391cfcf24a613f1f9c2
Instruction ID: 2c743b39172e14a23d0f334df08692735cc3878c99ef0d49e30ccbdd63c31ee3
Opcode Fuzzy Hash: a88527878aebe6bf81599ddc2a3e91b1cebf57b97ee23391cfcf24a613f1f9c2
Instruction Fuzzy Hash: FFE08C30A0110CFFCB40EFA5EA419ADB7BAEB84259B1185A8DC09E3304EB353F019F91

Uniqueness

Uniqueness Score: -1.00%

Function 05869958, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3c044f96818bc8c162b07588762e737c6123cf3ccb130e10b0666268c050bb
Instruction ID: e1c8e6cafa25c7fbb1d1cee68a0abe91c8875a978198f11cde8eb90d76d4dd17
Opcode Fuzzy Hash: 8f3c044f96818bc8c162b07588762e737c6123cf3ccb130e10b0666268c050bb
Instruction Fuzzy Hash: BDD0C9317101148FC704DB5DE44899537EDEF8D6A575000BAF50ACB3A1DEA1EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05860803, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ef68b720540b90a81cf2e3c531c29cc67aae0829763e3f6f4aa7d6b41bc2e8
Instruction ID: 37fe630321390cd4454139c85e8748e2249868b26b0cd06f1ece54b6bab19c94
Opcode Fuzzy Hash: c9ef68b720540b90a81cf2e3c531c29cc67aae0829763e3f6f4aa7d6b41bc2e8
Instruction Fuzzy Hash: 94D097037485C003CB0393B8682C78E3FC80F82618F8A00DE84D94B61BEA088607CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 05861A59, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6a857584dd1833cbb0c3af012601e50252b32682f27c11d795fd8d69f39640
Instruction ID: 38b272560fa6efb91d48ae2786bdc0013fd3aff2ad28c93519f3c247f0e807dd
Opcode Fuzzy Hash: 5f6a857584dd1833cbb0c3af012601e50252b32682f27c11d795fd8d69f39640
Instruction Fuzzy Hash: 44D0227D1083001EC325AB38FA0ECA17B74EB5231470250C2C8C09A07392149F0EE716

Uniqueness

Uniqueness Score: -1.00%

Function 05866BD8, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae38e64be66d0277f764992188c37389c8dfe3349297d62af51f917983258b3
Instruction ID: 6e0ddb6868478c24781317911b825691e3744105460e0345aa9c73b61370537f
Opcode Fuzzy Hash: 7ae38e64be66d0277f764992188c37389c8dfe3349297d62af51f917983258b3
Instruction Fuzzy Hash: 4EC04C3615010CABCB05AF55F90D85D7F6AEB98261B14C121FC5A46221DF71F9919AA0

Uniqueness

Uniqueness Score: -1.00%

Function 05861883, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e292ef1fd0bbebaed3c544e98c75b2538338c1f55a476038f1e6c8b30addcb
Instruction ID: d5b5ff6dd5c9fcdce19d8b4d74fb55d43768a628356fb628b0ce578c9246973a
Opcode Fuzzy Hash: 71e292ef1fd0bbebaed3c544e98c75b2538338c1f55a476038f1e6c8b30addcb
Instruction Fuzzy Hash: BBC08CFB4003049E8B00DB00CD49D44BAE66BA93007848A11A080C9022D220C85AE702

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05865AA0, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ee268d9c7bedf6a37ef4c1b7cdc55a20ea6338fff5a592e381c5c635984406
Instruction ID: 79278a7f04a986aa3724eb05810b40a33f40336b54d8f2d8e97ee3f06165e22f
Opcode Fuzzy Hash: b7ee268d9c7bedf6a37ef4c1b7cdc55a20ea6338fff5a592e381c5c635984406
Instruction Fuzzy Hash: F4D12730C2075ACACB10EFA4D99469DB7B1FF95200F618B9AD51A77250EF70AEC5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05865AB0, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.309303295.0000000005860000.00000040.00000001.sdmp, Offset: 05860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba899fe5add0ecec1560ce65c12d7932ac860d3d8880591124276a8b781761b
Instruction ID: 695151dcab1ef918f421008bdebaf79ecee29543b33384922199a126d4820fb9
Opcode Fuzzy Hash: 5ba899fe5add0ecec1560ce65c12d7932ac860d3d8880591124276a8b781761b
Instruction Fuzzy Hash: 73D11630C2065ECACB10EFA4D99469DB7B1FF95200F618B9AD51A77250EF70AEC5CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nxHHI8WXqt.exe PID: 6728 Parent PID: 5860 nxHHI8WXqt.exeCOMMON

Executed Functions

Function 013A0A70, Relevance: 5.5, APIs: 3, Instructions: 976libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013A0C07

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e837a090bd8ecbaf3c721acc8f0d2e11b0888851c4d4189536ee9f32c0fb893f
Instruction ID: 9febc4f7f5c740a6cb75e9761b40ffa51e27ad71177567eb8858a86ac7505495
Opcode Fuzzy Hash: e837a090bd8ecbaf3c721acc8f0d2e11b0888851c4d4189536ee9f32c0fb893f
Instruction Fuzzy Hash: F9A24974A01268CFCB64DF70D9546ADB7BAFF88209F1085E9D60AA3344DB395E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 061553AC, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0615BAB3

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d0d9c4c7f5bab5982a053f49fbc7cb91eacf8d7e60ed73224e0752acb3433dee
Instruction ID: 31b3979bc3e11e893be7c5b1279cf18b8d23cc66d146b1b1360be24b049558b7
Opcode Fuzzy Hash: d0d9c4c7f5bab5982a053f49fbc7cb91eacf8d7e60ed73224e0752acb3433dee
Instruction Fuzzy Hash: 3951F270D04218CFDB58CFA9C8A57ADFBB1BF48314F168519E825BB360DBB4A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 013A0A91, Relevance: 5.1, APIs: 3, Instructions: 632libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013A0C07

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ec4908e75baed0b7a65fae4afdfc37cc257fb3f51238600a4f03ba58b0eaf83f
Instruction ID: f8bfdad5865d45301845315e38984906cf7a96fa3b081ff240e04a8a8596c1fb
Opcode Fuzzy Hash: ec4908e75baed0b7a65fae4afdfc37cc257fb3f51238600a4f03ba58b0eaf83f
Instruction Fuzzy Hash: 97526A74901268CFCB64DF70D9646ADB7BAFF89209F1085E9D60AA3340DB389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A0AD6, Relevance: 5.1, APIs: 3, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013A0C07

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4fcbda401c1465c7e5478374877a72a6b63f925a8a6f14be33a62758c00de79c
Instruction ID: 62747255e336fb4397e9e0ee19fb9a057b9be71696efadb01916311d3ecf62e1
Opcode Fuzzy Hash: 4fcbda401c1465c7e5478374877a72a6b63f925a8a6f14be33a62758c00de79c
Instruction Fuzzy Hash: 3D525974901268CFCB64DF70D9646ADB7BAFF89209F1085E9D60AA3340DB389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A0F2F, Relevance: 3.5, APIs: 2, Instructions: 458COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5eaa29e8c7ccd338844fbe40aa6f091f3ce9a06f1ee250d4d23c917583f11f1c
Instruction ID: 086941d704a96eb13feefbee0737bb61bfe8206f713262fe5535a3e08fa6a4e0
Opcode Fuzzy Hash: 5eaa29e8c7ccd338844fbe40aa6f091f3ce9a06f1ee250d4d23c917583f11f1c
Instruction Fuzzy Hash: ED224B74900268CFCB69DF30C9646ADB7BAFF89249F5085E9C609A3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A0F74, Relevance: 3.5, APIs: 2, Instructions: 451COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 46f08cc892e3fc49daa0fc6f338825445aea59d3abc148b423c05ad685238629
Instruction ID: bceacbe87366909e8fd7f000af7adac0087d333cdf78ea27202a7a1dda78442a
Opcode Fuzzy Hash: 46f08cc892e3fc49daa0fc6f338825445aea59d3abc148b423c05ad685238629
Instruction Fuzzy Hash: B7225B74900268CFCB69DF30C9646ADB7BAFF89249F5085E9C609A3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A0FB9, Relevance: 3.4, APIs: 2, Instructions: 442COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 40e8e812dafb870d4f020fe73857c4c9a8e7fafd07ff1918b9aaa32bc6200db6
Instruction ID: 072ba7e22e2767ea9923a03613661cdd9f9bb3870949cec26610f3faf355207d
Opcode Fuzzy Hash: 40e8e812dafb870d4f020fe73857c4c9a8e7fafd07ff1918b9aaa32bc6200db6
Instruction Fuzzy Hash: 18224A74900268CFCB64DF30D9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A0FF5, Relevance: 3.4, APIs: 2, Instructions: 437COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b1d9ae24d6721f5dbddcb8bfbed2c92dbe779099161d26f072160e2246f94e1b
Instruction ID: b1f9bdccafd0aed6cfcbfb14095ca2e7b6b77b052ff5737c106c9bf636707d7d
Opcode Fuzzy Hash: b1d9ae24d6721f5dbddcb8bfbed2c92dbe779099161d26f072160e2246f94e1b
Instruction Fuzzy Hash: 0F223AB4900268CFCB64DF30D9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A103A, Relevance: 3.4, APIs: 2, Instructions: 430COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8cb36a3ea3baf41fc80a08ee55b6a4a4c93f19a1477d6dccca742c3909f719ee
Instruction ID: 0c747adfbea31f2e4cc3df62bb184ae95ccda33a1581d7d8aee6b3ee1b6e9574
Opcode Fuzzy Hash: 8cb36a3ea3baf41fc80a08ee55b6a4a4c93f19a1477d6dccca742c3909f719ee
Instruction Fuzzy Hash: E7225BB4900269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB349E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A107F, Relevance: 3.4, APIs: 2, Instructions: 423COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e6f19a3bdab3fc09d33df0f8a3d8ea99ca76047522bba22ecb90766c3aeaaacb
Instruction ID: d223595bbf94d71b319b4d957b974a352ce7418f4306fc7ff6fb4015f2b897e7
Opcode Fuzzy Hash: e6f19a3bdab3fc09d33df0f8a3d8ea99ca76047522bba22ecb90766c3aeaaacb
Instruction Fuzzy Hash: 93124BB4900268CFCB64DF30D9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A10C4, Relevance: 3.4, APIs: 2, Instructions: 414COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1ccff7533482443f5f0710b095249a63f2d7a0d96ab9b5ca258a20dd1d2a933e
Instruction ID: 3c5d7b89c091a690f4aa9512eb1e461f5c16a17b86c7dda072100ec043203b0e
Opcode Fuzzy Hash: 1ccff7533482443f5f0710b095249a63f2d7a0d96ab9b5ca258a20dd1d2a933e
Instruction Fuzzy Hash: EF125AB4901268CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB349E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1100, Relevance: 3.4, APIs: 2, Instructions: 407COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a3c0963d47b064402a092a858a5c69fd90e0ebd5d232cfb5f737cb078e805e0c
Instruction ID: 05b53edf836c7a1bd21b999893be00a6bea2505fd05347889faca16e0153314b
Opcode Fuzzy Hash: a3c0963d47b064402a092a858a5c69fd90e0ebd5d232cfb5f737cb078e805e0c
Instruction Fuzzy Hash: 06124AB4901268CFCB64DF30D8646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A113C, Relevance: 3.4, APIs: 2, Instructions: 402COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a346841afab8cb498218865be5e4d729c87d60f761f2af16342f7192515beea
Instruction ID: f75f10caa0421805d792c11d0192f8446fe93262f223dccc514d438824f2f293
Opcode Fuzzy Hash: 8a346841afab8cb498218865be5e4d729c87d60f761f2af16342f7192515beea
Instruction Fuzzy Hash: 78124AB4901269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB349E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1181, Relevance: 3.4, APIs: 2, Instructions: 395COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 40120d46fbd77aa0123422343d353c73655f51f2bca38326a2159738a37180c3
Instruction ID: 5e76e2220a93c594fa9b75e16881c45b2ff538b267badbfaedea99b7c59ff0a5
Opcode Fuzzy Hash: 40120d46fbd77aa0123422343d353c73655f51f2bca38326a2159738a37180c3
Instruction Fuzzy Hash: 70124AB4901268CFCB64DF30C8646ADB7BAFF89249F5085E9C60AA3340DB349E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A11C6, Relevance: 3.4, APIs: 2, Instructions: 388COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9c6691c129abca7bce5c709be4c00f60c0c969db5aa06640cd8f2ed5d21f9cbf
Instruction ID: ee49009e2d30a8237df2d1528939f8b638ac02f03491c03e7b03dc2c59f4710f
Opcode Fuzzy Hash: 9c6691c129abca7bce5c709be4c00f60c0c969db5aa06640cd8f2ed5d21f9cbf
Instruction Fuzzy Hash: E8024AB4901268CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB349E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A120B, Relevance: 3.4, APIs: 2, Instructions: 381COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 49276fa2ba3db1b09b960b8f458346c854783fc130b8cc337a33cb68c3b41d30
Instruction ID: df313a3f82e4da820cf4250b42b4e89d7b6344323dd0c4c3c7ea16b94595f613
Opcode Fuzzy Hash: 49276fa2ba3db1b09b960b8f458346c854783fc130b8cc337a33cb68c3b41d30
Instruction Fuzzy Hash: 7B023AB4901269CFCB64DF30C8646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1250, Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6e661a73576a90ff0f73c818f392fdf564c1707e9b5eb6022f4c8598a33dc512
Instruction ID: e43a949d11146403206d61cc52df2278c21089e122e65066041fee9045f7c023
Opcode Fuzzy Hash: 6e661a73576a90ff0f73c818f392fdf564c1707e9b5eb6022f4c8598a33dc512
Instruction Fuzzy Hash: F8024BB4900269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1295, Relevance: 3.4, APIs: 2, Instructions: 367COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 95012b317793a5898b91255894036f01e727368f59f0610b2eaf8d53626b70b8
Instruction ID: db926fd4792ad9681aba032e84447bd74a0e4abe5f6861ea5f79bca6a2339382
Opcode Fuzzy Hash: 95012b317793a5898b91255894036f01e727368f59f0610b2eaf8d53626b70b8
Instruction Fuzzy Hash: 50024BB4900269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A12DA, Relevance: 3.4, APIs: 2, Instructions: 360COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a53bfc14807bb5d94287356c284bd8f7f1bbdd848ce0ac1399f5bc4a651f4b6c
Instruction ID: a48725d04c28d4ce9f24c893ef90e4764f9e8c25fb9f989e4a5bdf87c6b5c585
Opcode Fuzzy Hash: a53bfc14807bb5d94287356c284bd8f7f1bbdd848ce0ac1399f5bc4a651f4b6c
Instruction Fuzzy Hash: 75024BB4900269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A131F, Relevance: 3.4, APIs: 2, Instructions: 353COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bd8b3c3ea184fa924fde396e1d80a7f6d479284fc1180f4949a63f2e63bc85ba
Instruction ID: 7be860ebb5220cf26392438e645c6e4c327fea6521aab11ff983832ec7660425
Opcode Fuzzy Hash: bd8b3c3ea184fa924fde396e1d80a7f6d479284fc1180f4949a63f2e63bc85ba
Instruction Fuzzy Hash: 35F11AB4900269CFCB64DF30C9646ADB7BAFF89249F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1364, Relevance: 3.3, APIs: 2, Instructions: 346COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1dc74edde6996f05fe235b556690aea35fbe1229589d8604fcbef116f0123d67
Instruction ID: 1f3a8548cd7c088aad6f1683ca55459e5bdab83ec0df5679ee494d3dd28d699c
Opcode Fuzzy Hash: 1dc74edde6996f05fe235b556690aea35fbe1229589d8604fcbef116f0123d67
Instruction Fuzzy Hash: A2F13CB4900269CFCB64DF30C9646ADB7BAFF89209F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A13A9, Relevance: 3.3, APIs: 2, Instructions: 337COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0439faad489317621c2fd0cb8a38c6802116275f091d2aa5662bcdd6cc473b35
Instruction ID: 70ebc9ab8637fd4f8c8c290c71b8e148b70a330646984d054af5144812d8bdb4
Opcode Fuzzy Hash: 0439faad489317621c2fd0cb8a38c6802116275f091d2aa5662bcdd6cc473b35
Instruction Fuzzy Hash: 88F12CB4901269CFCB64DF30C9646ADB7BAFF89209F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A13E5, Relevance: 3.3, APIs: 2, Instructions: 332COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 20de649381691e60cd854d55b23658b6b0235972cb08eb6c3e4a073619069de0
Instruction ID: be951cb906144f95f1c934606249d812ee177187ff6bcf6bdec4b67df5dc4eeb
Opcode Fuzzy Hash: 20de649381691e60cd854d55b23658b6b0235972cb08eb6c3e4a073619069de0
Instruction Fuzzy Hash: 36F13CB4901269CFCB64DF30C9646ADB7BAFF89209F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A142A, Relevance: 3.3, APIs: 2, Instructions: 325COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e18e5cdd2cede23a7355735ec256d7b4f3e126abe1ad247f8ec9035c2c2f156d
Instruction ID: 01c7e79d13ca480bd50b111cade282643aff34f1b6978290e476cdb99c533343
Opcode Fuzzy Hash: e18e5cdd2cede23a7355735ec256d7b4f3e126abe1ad247f8ec9035c2c2f156d
Instruction Fuzzy Hash: 1BE12BB4900269CFCB64DF70C9646ADB7BAFF89209F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1472, Relevance: 3.3, APIs: 2, Instructions: 318COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3b85464915fec30882c7d6aa56efe43c045b824aba49bbfe7ab736e4277d86c3
Instruction ID: 421c1b0fda94bfbc68b03e593e9333874f15fc0575a48b65366d681ad48b25bb
Opcode Fuzzy Hash: 3b85464915fec30882c7d6aa56efe43c045b824aba49bbfe7ab736e4277d86c3
Instruction Fuzzy Hash: C3E11BB4900269CFCB64DF70C9546ADB7B6FF89209F5085E9C60AA3340DB359E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A14BA, Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 868b758ac44115a2f07e983874da99b1d5b63e88c026d5c869436498fd87a9f7
Instruction ID: 2656cd14a4ea7dc7683388bf271d850ad05f4f3623e1062b965ac16e0531af5d
Opcode Fuzzy Hash: 868b758ac44115a2f07e983874da99b1d5b63e88c026d5c869436498fd87a9f7
Instruction Fuzzy Hash: 85E11AB4900269CFCB64DF70C9546ADB7B6FF89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1502, Relevance: 3.3, APIs: 2, Instructions: 304COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ffdcca2a2c478e72fa44d2716e20ea2ad540942219d26fd4c4407e8c0e390f94
Instruction ID: 11df7061f37632913ba0aa330f8c231d1f3c748f7e088dbdbe25950c56974a1a
Opcode Fuzzy Hash: ffdcca2a2c478e72fa44d2716e20ea2ad540942219d26fd4c4407e8c0e390f94
Instruction Fuzzy Hash: 3CE129B4A01269CFCB64DF30C9546ADB7B6FF89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A154A, Relevance: 3.3, APIs: 2, Instructions: 297COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e274342a6db8eaed64478e8b6326c14fc311fe9d509efd3aad936bf61a7cc03b
Instruction ID: 12ebe0bae24620845952baadd2d47b111cff47d7dff5c767f932a8363a9ffe73
Opcode Fuzzy Hash: e274342a6db8eaed64478e8b6326c14fc311fe9d509efd3aad936bf61a7cc03b
Instruction Fuzzy Hash: D1D119B4A01268CFCB64DF70C9546ADB7B6FF89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1592, Relevance: 3.3, APIs: 2, Instructions: 290COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0ec3ad3e9c76330a3f3118b155ed58d56f7217748dd7d340c53d858275e972bc
Instruction ID: 80265fc9282950c3d63ac24f6edd6f7759813ba73832462ed418857b748a7648
Opcode Fuzzy Hash: 0ec3ad3e9c76330a3f3118b155ed58d56f7217748dd7d340c53d858275e972bc
Instruction Fuzzy Hash: D3D119B4A00268CFCB64DF70C9546ADB7B6FF89209F5085E9C60AA3340DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A15DA, Relevance: 3.3, APIs: 2, Instructions: 283COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e69d350e1cfca6c8d90b151273c7a98b759a89b7e1dfd24a3bebd0aa6cd26353
Instruction ID: f5df9eb490a4b0acf62d4eb3b6df9a83d4751981f652b9b6932b174bcf925292
Opcode Fuzzy Hash: e69d350e1cfca6c8d90b151273c7a98b759a89b7e1dfd24a3bebd0aa6cd26353
Instruction Fuzzy Hash: F9D108B4A00268CFCB64DF70C9546ADB7B6FF89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1638, Relevance: 3.3, APIs: 2, Instructions: 272COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6081def1e400c0f4e2941843eb6bb65df4834c36e852563f66754f49b2ca4cd5
Instruction ID: c0093df6d7ca52f7658a079ed3fe1eb5b3487c9070332b217ba456307193e802
Opcode Fuzzy Hash: 6081def1e400c0f4e2941843eb6bb65df4834c36e852563f66754f49b2ca4cd5
Instruction Fuzzy Hash: 8AC117B4A01228CFCB64DF70C9546ADB7B6FB89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1680, Relevance: 3.3, APIs: 2, Instructions: 265COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c441d9c00a9cfc6f41824c8189cbced7ecf62f8df6a071d6caa6eaadd4f4ef4a
Instruction ID: 88c82648ba0975aa3dbbcb6d5d5c35f5d07e041dbcf6eb62d5553651eb7710fe
Opcode Fuzzy Hash: c441d9c00a9cfc6f41824c8189cbced7ecf62f8df6a071d6caa6eaadd4f4ef4a
Instruction Fuzzy Hash: 4BC107B4A01268CFCB64DF70C9546ADB7B6FB89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A16C8, Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 558d0f5991c581e2255be533b3faa2d6b45e35ac85e3ede20847cb699a36021f
Instruction ID: 80548f6d2e43487d65de8b90208a1fbfa165faf15c8db4be152c77769a5e4109
Opcode Fuzzy Hash: 558d0f5991c581e2255be533b3faa2d6b45e35ac85e3ede20847cb699a36021f
Instruction Fuzzy Hash: EFC108B4A01229CFCB64DF70C9547ADB7B6FB89209F5085E9C60AA3340DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1710, Relevance: 3.2, APIs: 2, Instructions: 249COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba2e6525da4724f0020a6cb34955ae95f4349241e007d6ad5b56805a4705636f
Instruction ID: 80b030724467fe61b31d7cac0d489336ef5d3e626df9360d202b80f212025720
Opcode Fuzzy Hash: ba2e6525da4724f0020a6cb34955ae95f4349241e007d6ad5b56805a4705636f
Instruction Fuzzy Hash: E9B108B4A01228CFCB64DF70C8547ADB7B6FB89209F5085E9C60AA3240DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A174C, Relevance: 3.2, APIs: 2, Instructions: 244COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 00661f9184ef2b742050f7a8c44b354f8b2bde5dbabf03223710205c36a8facc
Instruction ID: 38c0db7231ca1ef6e5795053f2624faac317130495ef67e43e3c630861430371
Opcode Fuzzy Hash: 00661f9184ef2b742050f7a8c44b354f8b2bde5dbabf03223710205c36a8facc
Instruction Fuzzy Hash: AEB107B4A01228CFCB64DF70C8547ADB7B6FB89209F5085E9C60AA3240DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1794, Relevance: 3.2, APIs: 2, Instructions: 237COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fb065ddcec44a5e25e705e2f6d42a07fd939f517ffef2edcbe608c74fb9d7487
Instruction ID: 93498918e3a5e7c07911a4ca29af6f26d67ca83526e5ebf0ca057e05bba18803
Opcode Fuzzy Hash: fb065ddcec44a5e25e705e2f6d42a07fd939f517ffef2edcbe608c74fb9d7487
Instruction Fuzzy Hash: 26B108B4A01268CFCB64DF74C8547ADB7B6FB88209F5085E9D60AA3240DB399E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A17DC, Relevance: 3.2, APIs: 2, Instructions: 230COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2c74fcd0bde248cda7d64d11610bc3d9a9aaae2fe0e72bf7be8b4181b4a87561
Instruction ID: c3c276e8f478d290a26941b52cab55457f547caada98d5a45bee24b5d0cdaa14
Opcode Fuzzy Hash: 2c74fcd0bde248cda7d64d11610bc3d9a9aaae2fe0e72bf7be8b4181b4a87561
Instruction Fuzzy Hash: 74A118B4A01229CBCB64DF74C9547ADB7B6FF88209F5085E9D60AA3340DB389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1824, Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e928169581502be691d010955d6bb601a48f970eb6fee88ad96ac66582f46c08
Instruction ID: e052aeac97629e5c8f18fe27329d05b2f4218a889c71f09c52905d28d8e39de8
Opcode Fuzzy Hash: e928169581502be691d010955d6bb601a48f970eb6fee88ad96ac66582f46c08
Instruction Fuzzy Hash: 39A119B4A01228CBCB64DF74C86476DB7B6FF88209F5085E9C609A3340DB389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A186C, Relevance: 3.2, APIs: 2, Instructions: 216COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c5c8e992585095c7f186647b5b62300a7f0dd68a96d1643538cb4095451ad556
Instruction ID: 278859bf501a62f1a0fd0515befff691d316fc39bcc91e6e24088cccc60c1cf1
Opcode Fuzzy Hash: c5c8e992585095c7f186647b5b62300a7f0dd68a96d1643538cb4095451ad556
Instruction Fuzzy Hash: 4A9118B4A01228CBDB64DF74C8547ADB7B6FF88209F5085E9C60AA3340DB389E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A18B4, Relevance: 3.2, APIs: 2, Instructions: 209COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A18DB
KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 16c57205fe54cbb87df278f7661f6d35b28abfa28ebaae574b6a49f86dd17869
Instruction ID: 82ba1c79bf853ec9ba286ecfc4968f6188c43a03e4b8be23f6914f6adec388d4
Opcode Fuzzy Hash: 16c57205fe54cbb87df278f7661f6d35b28abfa28ebaae574b6a49f86dd17869
Instruction Fuzzy Hash: 359108B4A01229CBDB64DF74C8547ADB7B6FB88209F5085E9C60AA3240DB389E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A18FC, Relevance: 1.7, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e54fa05a4d1acc8117bb662a8c0b139a54457a00410ffb8178d8194a7ff88284
Instruction ID: ea50843e7cccbab7ec75b8460e963d9198b3d2e7ef9f50e7efa412fa7fbd8789
Opcode Fuzzy Hash: e54fa05a4d1acc8117bb662a8c0b139a54457a00410ffb8178d8194a7ff88284
Instruction Fuzzy Hash: 81911974A012298BDB64EF74C9547AEB7B6FF88209F5084E9C609A3340DF389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A1944, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 53b5369f18cd0ac5b1bb190e5f086794877f51b1205a794d74b515e534fea3c0
Instruction ID: 50baaffe0a7528e4faa270b0c79c9313e962af7e4f5e02586c1022d41b35b4dd
Opcode Fuzzy Hash: 53b5369f18cd0ac5b1bb190e5f086794877f51b1205a794d74b515e534fea3c0
Instruction Fuzzy Hash: 78810974A012298BDB64EF74C8547AEB7B6FF88209F5084E9C609A3341DF389E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 013A198C, Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 013A19B3

Memory Dump Source

Source File: 00000012.00000002.556058987.00000000013A0000.00000040.00000010.sdmp, Offset: 013A0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 821272cdf36e7e4d81b145d4d271da8f2738ff947a0db0aba64d3a07bb7d2714
Instruction ID: d226ccb68d12d6eddc2175edd9233ba68213ad3e1a2a712fadab43adbc4abc03
Opcode Fuzzy Hash: 821272cdf36e7e4d81b145d4d271da8f2738ff947a0db0aba64d3a07bb7d2714
Instruction Fuzzy Hash: 4F812A74A012298BDB64EF74C8547AEB7B6EF84209F5088E9C609A3340DF389E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 011452B2, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01145422

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3ef242ba757e2777c67b4c883d434211aaf2a0d216184b59bb1556665d54b2dd
Instruction ID: 43cd228ee57d53d759a87d9f6bd17a1e79e25844f06962da69d4ac83190e7775
Opcode Fuzzy Hash: 3ef242ba757e2777c67b4c883d434211aaf2a0d216184b59bb1556665d54b2dd
Instruction Fuzzy Hash: 3051D3B1D00249EFDF15CF99C980ADDBFB6BF48314F28812AE918AB220D7759855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0615B96C, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0615BAB3

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ef90236604fde29f70bdcdab515aec6b032e33f463db71b8e9f6d01879fe0449
Instruction ID: b863e214aafeec28925fb358dee894b1e8f1fe80ed6a6722b06aa4e733cdcf6d
Opcode Fuzzy Hash: ef90236604fde29f70bdcdab515aec6b032e33f463db71b8e9f6d01879fe0449
Instruction Fuzzy Hash: 67511270D04218CFDB58CFA9C8A57ADFBF1BF48314F158529E825BB261DBB4A844CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0615974C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0615BAB3

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1a4b390ab51288e707daeb4bef0f9ea3ad6485c689c09a27b2f9e101fabaf10b
Instruction ID: aa337103c9bd257d5de5d47a33e48df75f4e1ce23eb46f4d922b3bd13d134718
Opcode Fuzzy Hash: 1a4b390ab51288e707daeb4bef0f9ea3ad6485c689c09a27b2f9e101fabaf10b
Instruction Fuzzy Hash: 9751F270D04218CFDB58CFA9C8A57ADFBB1BF48314F158519E825BB360DBB4A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01441218, Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.556420700.0000000001440000.00000040.00000010.sdmp, Offset: 01440000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cb257bac8a11defec2af42dab79850529a89a9794d9c17acefb6dcdefcc9c6
Instruction ID: d966edf5e49f77f16a38861b52aec6f0b5ac1bf31f33fb70b0eae3b7bdd4a488
Opcode Fuzzy Hash: e5cb257bac8a11defec2af42dab79850529a89a9794d9c17acefb6dcdefcc9c6
Instruction Fuzzy Hash: C0412271D043468FCB15DFB9C8042DEBBF5BF8A220F1485AAD448E7251DB78A885CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01143E1C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01145422

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f85ad3504f356f0211f9b32ad639831e52cfbbb652884c85ecbb9dcc84274b83
Instruction ID: 46f3e31fb3487d3d0df37fce858c668340a0bd5abc72219463115c910e80cddc
Opcode Fuzzy Hash: f85ad3504f356f0211f9b32ad639831e52cfbbb652884c85ecbb9dcc84274b83
Instruction Fuzzy Hash: EE51C2B1D00309DFDB18CF99C884ADEBBF6BF48714F64852AE919AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01146AFC, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01147D79

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 885e642cc1ac1a23fc0179ed7eecf388bcb2eff71361132c740df0f29185e68f
Instruction ID: ba34e741300be739d945bd4f05372bdabe57bb38a164d18a2b4ac04b18ef738d
Opcode Fuzzy Hash: 885e642cc1ac1a23fc0179ed7eecf388bcb2eff71361132c740df0f29185e68f
Instruction Fuzzy Hash: 57414CB59103458FCB18CF99C488AAEFBF9FF88714F248459D519AB361C734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0615D285, Relevance: 1.6, APIs: 1, Instructions: 79comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 0615D318

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: b2d6b376a0869f119a33bcd9b51ff71c38333f294ae676d940548de3465c6586
Instruction ID: 8ec2efb3eb0ff68f806a566f502de0608e2f628c458ab1febd4d81c5cab71338
Opcode Fuzzy Hash: b2d6b376a0869f119a33bcd9b51ff71c38333f294ae676d940548de3465c6586
Instruction Fuzzy Hash: 363122B0E01208DFDB54CF99D984BCEBBF5AF48314F248429E404AB394DBB4A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0114C959, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0114C9E2

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 13c9de76c9d11f87e3f27edda6f4a6b0ef4ee2ec15cd95305304ff1ceaf7fdff
Instruction ID: f7345d2eeb05d715e15dd145750bb28238b8941443ed610341da2f85c2e2127f
Opcode Fuzzy Hash: 13c9de76c9d11f87e3f27edda6f4a6b0ef4ee2ec15cd95305304ff1ceaf7fdff
Instruction Fuzzy Hash: AB31CD758013459FCB15DFA9DA8A3DABFF4FB05318F28845AD445A3242D7785804CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0615CC00, Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 0615D318

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 7606c7ed2ac90412c74581111601dca67eccbdbc687021632fd15653a9d070b5
Instruction ID: ae51daadc6ca930ce91ae458d64058d2c7ace17dd665151ee8d413a4aa9060bc
Opcode Fuzzy Hash: 7606c7ed2ac90412c74581111601dca67eccbdbc687021632fd15653a9d070b5
Instruction Fuzzy Hash: EF3111B0E00208DFDB54CF99D984BDEBBF5AF48314F248429E404AB290DBB4A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0615C590, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,0615C57F), ref: 0615C61F

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 489ee2e9b4befc338d30cdccfbfcf2485af4eaf995ff2578d61f9ecbcad65db7
Instruction ID: f3df55c7509ccd127680fbc0089a2ee443db7c97c0c1d8cffc7a1405ca31668d
Opcode Fuzzy Hash: 489ee2e9b4befc338d30cdccfbfcf2485af4eaf995ff2578d61f9ecbcad65db7
Instruction Fuzzy Hash: 1F2186B08007498FCB10CFAED8447DEFBF8AF49724F14885AD569B3610CB38A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01146DE0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01146E6F

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3216544e4f112394ae7a67c45e89e06e193512cb3a717ca38b864e56fcd04a9a
Instruction ID: 9d38cec9d46436902ed26e41b5f8a4ce00a85a1f91b5e1bbaccdd45538dab967
Opcode Fuzzy Hash: 3216544e4f112394ae7a67c45e89e06e193512cb3a717ca38b864e56fcd04a9a
Instruction Fuzzy Hash: CB21E4B59002199FDB10CFA9D984AEEBBF8FF48324F14851AE924B3350D778A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01146DE8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01146E6F

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1f77a9b6915ba7f8afa26d4dfbf59e75a3a18a55d39012877750eff57c1cb6d7
Instruction ID: a8e21956c21f83b3c438bbe13e29b79562a2a3a25cbcd419fe39ac058772ee0d
Opcode Fuzzy Hash: 1f77a9b6915ba7f8afa26d4dfbf59e75a3a18a55d39012877750eff57c1cb6d7
Instruction Fuzzy Hash: 3621C4B59002199FDB10CF9AD984ADEBBF8EB48324F14841AE914B3310D778A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014412E8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 01441357

Memory Dump Source

Source File: 00000012.00000002.556420700.0000000001440000.00000040.00000010.sdmp, Offset: 01440000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4386c509f3f2136e0cfc3363aa6757bc088903a4cf967839423307e7b79c044c
Instruction ID: 5255bc9114f98d8e04d53878d4b263d60847869fef3d23cd5281621c54dd3d1b
Opcode Fuzzy Hash: 4386c509f3f2136e0cfc3363aa6757bc088903a4cf967839423307e7b79c044c
Instruction Fuzzy Hash: E1112FB1C0061A9FDB10CFAAC444BDEFBF4AF48624F14866AD818A7610D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0114C968, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0114C9E2

Memory Dump Source

Source File: 00000012.00000002.553828398.0000000001140000.00000040.00000001.sdmp, Offset: 01140000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 3fbea9efc5732c4a66437f01f09f65136849873ccbc66bcdea4c23b4840010bb
Instruction ID: b12e47b6e9ee1314e6cda4a72ca82e458c1d69457b4429ee4fca82213773f886
Opcode Fuzzy Hash: 3fbea9efc5732c4a66437f01f09f65136849873ccbc66bcdea4c23b4840010bb
Instruction Fuzzy Hash: 331189B59013059FCB24DFAAC5493DEBBF4FB44314F24882AD405A3740DB38A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06159774, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,0615C57F), ref: 0615C61F

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c9e4e78acaef6caa8066916e877212cb54220f272b36c7e714d3d3095189ade0
Instruction ID: a72fa18ff227e2eca6efac446c6787a66761763048b14d36cf5a0e816f29e855
Opcode Fuzzy Hash: c9e4e78acaef6caa8066916e877212cb54220f272b36c7e714d3d3095189ade0
Instruction Fuzzy Hash: 6D1102B59003498FCB10CF9AD5887DEFBF8AB88324F148819D929A7210D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0615D140, Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0615D19D

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 142f1a2155fe70de4814a59e896cd441a07c0cea9c1b0dcd83e9a7907aa934c3
Instruction ID: 00dea3984ba66f30ca54de677ea7c39880bf9ad14747fe77d8ce956f70f00375
Opcode Fuzzy Hash: 142f1a2155fe70de4814a59e896cd441a07c0cea9c1b0dcd83e9a7907aa934c3
Instruction Fuzzy Hash: 7E1103B5900249DFCB20CF9AD985BDEFBF8EF48324F148459D918A7600C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0615CAEC, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0615D19D

Memory Dump Source

Source File: 00000012.00000002.560157375.0000000006150000.00000040.00000001.sdmp, Offset: 06150000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2a7b5e58c874c344ce2d728e64a98f20ef981a1d32a061285a55c470e33627af
Instruction ID: 238c31fd557aaa503a65aa0e7c2c157e52a0934a838018289db2639429d798bd
Opcode Fuzzy Hash: 2a7b5e58c874c344ce2d728e64a98f20ef981a1d32a061285a55c470e33627af
Instruction Fuzzy Hash: FE1103B5D00609CFCB60DF9AD9847DEFBF8EB48224F148859D919A7600C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report nxHHI8WXqt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre