Play interactive tour

Edit tour

Analysis Report CoYUNxCu9sAz7iQ.exe

Overview

General Information

Sample Name:	CoYUNxCu9sAz7iQ.exe
Analysis ID:	323808
MD5:	4651a16a7a526ea71500c4e740d1b445
SHA1:	35c54c7553ceefc195da495916d063c0d0b78429
SHA256:	01818bdf91663237419fae1f1c7613108a4321d9e354478df9a90d091126ad92
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM_3

.NET source code contains potential unpacker

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

CoYUNxCu9sAz7iQ.exe (PID: 4532 cmdline: 'C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe' MD5: 4651A16A7A526EA71500C4E740D1B445)

schtasks.exe (PID: 3068 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

CoYUNxCu9sAz7iQ.exe (PID: 5956 cmdline: {path} MD5: 4651A16A7A526EA71500C4E740D1B445)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "OLNf4ayHpxAP", "URL: ": "http://Tu6Zp5Arx4D.com", "To: ": "laty.lambo101@yandex.com", "ByHost: ": "mail.nusatek.com:587", "Password: ": "uTERCX", "From: ": "salina@nusatek.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.367073975.0000000003840000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 5956	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 5956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 4532	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 4532	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.CoYUNxCu9sAz7iQ.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe' , ParentImage: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe, ParentProcessId: 4532, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp', ProcessId: 3068

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: CoYUNxCu9sAz7iQ.exe.5956.3.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "OLNf4ayHpxAP", "URL: ": "http://Tu6Zp5Arx4D.com", "To: ": "laty.lambo101@yandex.com", "ByHost: ": "mail.nusatek.com:587", "Password: ": "uTERCX", "From: ": "salina@nusatek.com"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\FOPVbE.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Show sources

Source: CoYUNxCu9sAz7iQ.exe	Virustotal: Detection: 60%			Perma Link
Source: CoYUNxCu9sAz7iQ.exe	ReversingLabs: Detection: 47%

Source: 3.2.CoYUNxCu9sAz7iQ.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Code function: 4x nop then jmp 08F1969Ah

0_2_08F188B1

Source: global traffic

TCP traffic: 192.168.2.6:49753 -> 103.6.198.43:587

Source: Joe Sandbox View

IP Address: 103.6.198.43 103.6.198.43

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: global traffic

TCP traffic: 192.168.2.6:49753 -> 103.6.198.43:587

Source: unknown

DNS traffic detected: queries for: g.msn.com

Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610550515.00000000033BF000.00000004.00000001.sdmp	String found in binary or memory: http://Tu6Zp5Arx4D.com
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610420870.0000000003393000.00000004.00000001.sdmp	String found in binary or memory: http://mail.nusatek.com
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610420870.0000000003393000.00000004.00000001.sdmp	String found in binary or memory: http://nusatek.com
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365389915.0000000000CC7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365389915.0000000000CC7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000003.344294408.0000000000CCC000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comn-u
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: http://xUHTrW.com
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Code function: 3_2_0157D5A8 SetWindowsHookExW 0000000D,00000000,?,?

3_2_0157D5A8

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Jump to behavior

System Summary:

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_00C9C124	0_2_00C9C124
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_00C9E562	0_2_00C9E562
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_00C9E570	0_2_00C9E570
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F188B1	0_2_08F188B1
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F16E35	0_2_08F16E35
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F15711	0_2_08F15711
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F17361	0_2_08F17361
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F16E7B	0_2_08F16E7B
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F12FFC	0_2_08F12FFC
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_00CA7A46	3_2_00CA7A46
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_00CA79B3	3_2_00CA79B3
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01357D38	3_2_01357D38
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01351524	3_2_01351524
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0135AF60	3_2_0135AF60
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01350DF0	3_2_01350DF0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01352FCC	3_2_01352FCC
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01355419	3_2_01355419
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0135C658	3_2_0135C658
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01350040	3_2_01350040
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01359962	3_2_01359962
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01355750	3_2_01355750
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01354CA0	3_2_01354CA0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01362D50	3_2_01362D50
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0136B990	3_2_0136B990
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01362768	3_2_01362768
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01361FE0	3_2_01361FE0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0136CAA8	3_2_0136CAA8
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01367D67	3_2_01367D67
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01367DAF	3_2_01367DAF
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01368998	3_2_01368998
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_013679E0	3_2_013679E0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_013680BE	3_2_013680BE
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0136E610	3_2_0136E610
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01367E11	3_2_01367E11
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01571620	3_2_01571620
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_015745C9	3_2_015745C9
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0157F1FA	3_2_0157F1FA
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01572490	3_2_01572490
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01572481	3_2_01572481
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_0157A8A0	3_2_0157A8A0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_015723EF	3_2_015723EF
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01574798	3_2_01574798

Source: CoYUNxCu9sAz7iQ.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FOPVbE.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamecQqlOorQjnnEpSPBHdCcxgRBhGhhrYwRq.exe4 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename8S.exe2 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.382433231.0000000009600000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.382433231.0000000009600000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.382236670.0000000009500000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.607341251.00000000010F8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608705096.00000000015A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613755581.00000000061E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000000.362063092.0000000000D20000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename8S.exe2 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608691839.0000000001590000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamecQqlOorQjnnEpSPBHdCcxgRBhGhhrYwRq.exe4 vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608672864.0000000001580000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs CoYUNxCu9sAz7iQ.exe
Source: CoYUNxCu9sAz7iQ.exe	Binary or memory string: OriginalFilename8S.exe2 vs CoYUNxCu9sAz7iQ.exe

Source: CoYUNxCu9sAz7iQ.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FOPVbE.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/3@3/1

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File created: C:\Users\user\AppData\Roaming\FOPVbE.exe

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\neqAzGQdzUguTmpeiN
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3528:120:WilError_01

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7077.tmp

Jump to behavior

Source: CoYUNxCu9sAz7iQ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: CoYUNxCu9sAz7iQ.exe	Virustotal: Detection: 60%
Source: CoYUNxCu9sAz7iQ.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File read: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe 'C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe {path}
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process created: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: CoYUNxCu9sAz7iQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: CoYUNxCu9sAz7iQ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: CoYUNxCu9sAz7iQ.exe, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: FOPVbE.exe.0.dr, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.CoYUNxCu9sAz7iQ.exe.210000.0.unpack, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.CoYUNxCu9sAz7iQ.exe.210000.0.unpack, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.CoYUNxCu9sAz7iQ.exe.ca0000.1.unpack, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.CoYUNxCu9sAz7iQ.exe.ca0000.0.unpack, SimpleTextEditor/LoginForm.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_00218CC6 push ss; iretd	0_2_00218CE6
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_0021829A push 00000000h; iretd	0_2_002182A0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_00218CDF push ss; iretd	0_2_00218CE6
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F12BF6 push FFFFFFA9h; ret	0_2_08F12BF8
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 0_2_08F10694 push ss; retf	0_2_08F10696
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_00CA81C9 push 00000000h; iretd	3_2_00CA82A0
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_00CA8CC6 push ss; iretd	3_2_00CA8CE6
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_00CA8CDF push ss; iretd	3_2_00CA8CE6
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Code function: 3_2_01357A25 push esp; iretd	3_2_01357A26

Source: initial sample	Static PE information: section name: .text entropy: 7.7396642698
Source: initial sample	Static PE information: section name: .text entropy: 7.7396642698

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File created: C:\Users\user\AppData\Roaming\FOPVbE.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp'

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 4532, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Window / User API: threadDelayed 4502	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Window / User API: threadDelayed 8746	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Window / User API: threadDelayed 1109	Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe TID: 2976	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe TID: 4524	Thread sleep time: -41500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe TID: 7124	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe TID: 7020	Thread sleep count: 8746 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe TID: 7020	Thread sleep count: 1109 > 30	Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613755581.00000000061E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613755581.00000000061E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613755581.00000000061E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366503078.00000000029C1000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613755581.00000000061E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Code function: 3_2_01351524 LdrInitializeThunk,

3_2_01351524

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Memory written: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Process created: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe {path}			Jump to behavior

Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608956751.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608956751.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608956751.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: CoYUNxCu9sAz7iQ.exe, 00000003.00000002.608956751.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.367073975.0000000003840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 5956, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 4532, type: MEMORY
Source: Yara match	File source: 3.2.CoYUNxCu9sAz7iQ.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 5956, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.367073975.0000000003840000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 5956, type: MEMORY
Source: Yara match	File source: Process Memory Space: CoYUNxCu9sAz7iQ.exe PID: 4532, type: MEMORY
Source: Yara match	File source: 3.2.CoYUNxCu9sAz7iQ.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Obfuscated Files or Information3	Input Capture21	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing13	Credentials in Registry1	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion14	LSA Secrets	Virtualization/Sandbox Evasion14	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection112	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CoYUNxCu9sAz7iQ.exe	60%	Virustotal		Browse
CoYUNxCu9sAz7iQ.exe	48%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\FOPVbE.exe	48%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.CoYUNxCu9sAz7iQ.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
nusatek.com	0%	Virustotal		Browse
mail.nusatek.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.tiro.comn-u	0%	Avira URL Cloud	safe
http://nusatek.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://Tu6Zp5Arx4D.com	0%	Avira URL Cloud	safe
http://mail.nusatek.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://xUHTrW.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nusatek.com	103.6.198.43	true	true	0%, Virustotal, Browse	unknown
g.msn.com	unknown	unknown	false		high
mail.nusatek.com	unknown	unknown	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.613928909.0000000006440000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.tiro.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365389915.0000000000CC7000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.come.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365389915.0000000000CC7000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.orgGETMozilla/5.0	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.tiro.comn-u	CoYUNxCu9sAz7iQ.exe, 00000000.00000003.344294408.0000000000CCC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%telegramapi%/	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	false		high
http://nusatek.com	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610420870.0000000003393000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://Tu6Zp5Arx4D.com	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610550515.00000000033BF000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://mail.nusatek.com	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.610420870.0000000003393000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.fonts.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://xUHTrW.com	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.369526004.0000000005570000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	CoYUNxCu9sAz7iQ.exe, 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	CoYUNxCu9sAz7iQ.exe, 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, CoYUNxCu9sAz7iQ.exe, 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.6.198.43	unknown	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	323808
Start date:	27.11.2020
Start time:	15:23:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CoYUNxCu9sAz7iQ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/3@3/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 105 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, wermgr.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 13.88.21.125, 51.104.144.132, 52.155.217.156, 20.54.26.129, 2.20.142.210, 2.20.142.209, 40.67.251.132, 52.147.198.201, 52.142.114.176, 92.122.213.247, 92.122.213.194, 52.154.66.52, 52.154.67.2, 52.154.67.48, 52.154.66.239, 52.224.75.92, 52.154.67.56, 104.79.90.110 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, blu-eap-main-ips-v4only.b.lg.prod.aadmsa.trafficmanager.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, db5p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, login.live.com, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, skypedataprdcoleus16.cloudapp.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, www.tm.lg.prod.aadmsa.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:24:33	API Interceptor	777x Sleep call for process: CoYUNxCu9sAz7iQ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
103.6.198.43	JRN7EZAZ.EXE	Get hash	malicious	Browse
	zGyEJygJdB9gQUU.exe	Get hash	malicious	Browse
	SGVVGTQI.EXE	Get hash	malicious	Browse
	DQ0lO8gVkO.exe	Get hash	malicious	Browse
	5GVTZR5R.EXE	Get hash	malicious	Browse
	gHw9MlUsKBbvwaP.exe	Get hash	malicious	Browse
	JpzOOD0oTm.exe	Get hash	malicious	Browse
	I9Z33XjGakOIOoH.exe	Get hash	malicious	Browse
	4Yn6GnIPrbXA7vi.exe	Get hash	malicious	Browse
	4Yn6GnIPrbXA7vi.exe	Get hash	malicious	Browse
	XG8UDAIJ.EXE	Get hash	malicious	Browse
	Y6HpqlElKD0lLoa.exe	Get hash	malicious	Browse
	f5I39y4FB2DX7aM.exe	Get hash	malicious	Browse
	UPWQTZDV.EXE	Get hash	malicious	Browse
	bPlvM3WIdzoADDa.exe	Get hash	malicious	Browse
	QIVUQCMF.EXE	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	2281.xls	Get hash	malicious	Browse	103.6.196.179
	2281.xls	Get hash	malicious	Browse	103.6.196.179
	Invoice_Payment Form_163142.xlsm	Get hash	malicious	Browse	110.4.45.148
	Original Shipment Document.exe	Get hash	malicious	Browse	110.4.45.145
	JRN7EZAZ.EXE	Get hash	malicious	Browse	103.6.198.43
	7nFOggQ2PE.exe	Get hash	malicious	Browse	103.6.196.121
	8zQf02MJSy.exe	Get hash	malicious	Browse	103.6.196.156
	j470QOQdWq.exe	Get hash	malicious	Browse	103.6.196.121
	zGyEJygJdB9gQUU.exe	Get hash	malicious	Browse	103.6.198.43
	SGVVGTQI.EXE	Get hash	malicious	Browse	103.6.198.43
	G4lV5bMc0l.exe	Get hash	malicious	Browse	103.6.196.156
	DQ0lO8gVkO.exe	Get hash	malicious	Browse	103.6.198.43
	HoQ00lJBmx.exe	Get hash	malicious	Browse	103.6.196.121
	D5rekL72q0.exe	Get hash	malicious	Browse	103.6.196.156
	Information du octobre 2020.doc	Get hash	malicious	Browse	110.4.47.219
	5GVTZR5R.EXE	Get hash	malicious	Browse	103.6.198.43
	egskZqWRhqoU0fJ.exe	Get hash	malicious	Browse	103.6.196.156
	eJQspuSPzUmj5H4.exe	Get hash	malicious	Browse	103.6.196.156
	Sztuis104rOKP2P.exe	Get hash	malicious	Browse	103.6.196.156
	https://www.rehdainstitute.com/.well-known/RFT/c2xvbmdpbkByZXZlbnVld2VsbC5jb20=	Get hash	malicious	Browse	110.4.43.99

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CoYUNxCu9sAz7iQ.exe.log Download File
Process:	C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.345637324625647
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz5
MD5:	6C42AAF2F2FABAD2BAB70543AE48CEDB
SHA1:	8552031F83C078FE1C035191A32BA43261A63DA9
SHA-256:	51D07DD061EA9665DA070B95A4AC2AC17E20524E30BF6A0DA8381C2AF29CA967
SHA-512:	014E89857B811765EA7AA0B030AB04A2DA1957571608C4512EC7662F6A4DCE8B0409626624DABC96CBFF079E7F0F4A916E6F49C789E00B6E46AD37C36C806DCA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp7077.tmp Download File
Process:	C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	5.158412337470319
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3pHtn:cbha7JlNQV/rydbz9I3YODOLNdq3DN
MD5:	CC524AE00308E9D28F7C17F0C3BEA972
SHA1:	7AC144F6B5E1E3B6A3D9854A311BDBC2306BE70D
SHA-256:	09F7B20150CAB3275EB9AFB58441190D324730F5345A8F2E22F0F2513E3DD997
SHA-512:	9A609CDF5516D201EDD641402CA5BB556A8E31421445799C68202B239B31583A9AE0FC94C3E19D3C6291E13BEA5F23EDB4C3E63DCBEDED405B66B8D0B17BA24A
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail

C:\Users\user\AppData\Roaming\FOPVbE.exe Download File
Process:	C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	526848
Entropy (8bit):	7.727874815455438
Encrypted:	false
SSDEEP:	12288:V+b4KO3VrN2iNUPzvUuFxrNso8E7osJRkq3rat8LF:gb4KO3BN1WPzdFEozlvrG8
MD5:	4651A16A7A526EA71500C4E740D1B445
SHA1:	35C54C7553CEEFC195DA495916D063C0D0B78429
SHA-256:	01818BDF91663237419FAE1F1C7613108A4321D9E354478DF9A90D091126AD92
SHA-512:	607A15A9D550AED91712EE852F3B1B955BAABDAFB276FF302C64AB7DA81065059EB7411E24159FC16ACB5F559DE28D69ADBADCD283496E10AB34F03DA6525F61
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 48%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O._..............0......D......f.... ........@.. ....................................@.....................................O........A...................`....................................................... ............... ..H............text...l.... ...................... ..`.rsrc....A.......B..................@..@.reloc.......`......................@..B................H.......H........r...c......x...L................................................0..G.........}.....(.......(......s....}.....{.....o.....(......{.....{....o.......0...........(.....{....{....(.......(....~....vl....,..{....{....o......{....{.....o....o......{....(....}.....o......3..{....{....o.......+....,@..{....{....o....s......{.....{....{....o......{....{....o.........{....( ...o!.....{....~....o".......{....(#...o!.....{....~....o".......0..+.........,..{.......+....,...{.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.727874815455438
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	CoYUNxCu9sAz7iQ.exe
File size:	526848
MD5:	4651a16a7a526ea71500c4e740d1b445
SHA1:	35c54c7553ceefc195da495916d063c0d0b78429
SHA256:	01818bdf91663237419fae1f1c7613108a4321d9e354478df9a90d091126ad92
SHA512:	607a15a9d550aed91712ee852f3b1b955baabdafb276ff302c64ab7da81065059eb7411e24159fc16acb5f559de28d69adbadcd283496e10ab34f03da6525f61
SSDEEP:	12288:V+b4KO3VrN2iNUPzvUuFxrNso8E7osJRkq3rat8LF:gb4KO3BN1WPzdFEozlvrG8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O._..............0......D......f.... ........@.. ....................................@................................

File Icon


Icon Hash:	061b331d55675307

Static PE Info

General
Entrypoint:	0x47e266
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FBF4FA6 [Thu Nov 26 06:48:06 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e214	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x418c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7c26c	0x7c400	False	0.837456378898	data	7.7396642698	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x418c	0x4200	False	0.596117424242	data	5.50871998012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x80190	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x805f8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967039, next used block 4294967295
RT_ICON	0x816a0	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295
RT_GROUP_ICON	0x83c48	0x30	data
RT_VERSION	0x83c78	0x328	data
RT_MANIFEST	0x83fa0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016 - 2020
Assembly Version	1.0.0.0
InternalName	8S.exe
FileVersion	1.0.0.0
CompanyName	Vendetta Inc.
LegalTrademarks
Comments
ProductName	Aku Form
ProductVersion	1.0.0.0
FileDescription	Aku Form
OriginalFilename	8S.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/27/20-15:25:11.692530	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.6	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2020 15:26:22.669672012 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:22.992970943 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:22.993104935 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:23.815403938 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:23.816065073 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.139399052 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.140218019 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.469810009 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.523279905 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.553596973 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.892113924 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.892149925 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.892168045 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.892180920 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.892271042 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.892318010 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.896862030 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:24.945151091 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:24.953711033 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:25.277616024 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:25.320189953 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:25.598146915 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:25.922080040 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:25.926378965 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:26.250798941 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:26.253868103 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:26.616332054 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:26.620827913 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:26.622385025 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:26.945966959 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:26.946738005 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.272370100 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.273055077 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.596244097 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.598881960 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.599049091 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.599800110 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.599934101 CET	49753	587	192.168.2.6	103.6.198.43
Nov 27, 2020 15:26:27.922245979 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.922281981 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.922611952 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.923075914 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.936120987 CET	587	49753	103.6.198.43	192.168.2.6
Nov 27, 2020 15:26:27.976623058 CET	49753	587	192.168.2.6	103.6.198.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2020 15:24:20.468957901 CET	60261	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:24:20.496216059 CET	53	60261	8.8.8.8	192.168.2.6
Nov 27, 2020 15:24:21.285037994 CET	56061	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:24:21.312120914 CET	53	56061	8.8.8.8	192.168.2.6
Nov 27, 2020 15:24:22.102268934 CET	58336	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:24:22.129487991 CET	53	58336	8.8.8.8	192.168.2.6
Nov 27, 2020 15:24:25.155627012 CET	53781	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:24:25.191222906 CET	53	53781	8.8.8.8	192.168.2.6
Nov 27, 2020 15:24:48.007899046 CET	54064	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:24:48.035337925 CET	53	54064	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:06.875039101 CET	52811	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:06.914865971 CET	53	52811	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:07.471039057 CET	55299	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:07.506573915 CET	53	55299	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:07.952738047 CET	63745	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:07.979890108 CET	53	63745	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:08.282535076 CET	50055	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:08.317938089 CET	53	50055	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:08.662797928 CET	61374	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:08.678622961 CET	50339	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:08.698225975 CET	53	61374	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:08.705697060 CET	53	50339	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:08.719943047 CET	63307	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:08.757446051 CET	53	63307	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:09.097336054 CET	49694	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:09.132934093 CET	53	49694	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:09.583522081 CET	54982	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:09.619036913 CET	53	54982	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:10.249325037 CET	50010	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:11.244841099 CET	50010	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:11.690782070 CET	53	50010	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:11.692442894 CET	53	50010	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:12.285501003 CET	63718	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:12.321007013 CET	53	63718	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:13.031722069 CET	62116	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:13.051517010 CET	63816	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:13.067358017 CET	53	62116	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:13.078581095 CET	53	63816	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:13.498667955 CET	55014	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:13.534315109 CET	53	55014	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:13.707174063 CET	62208	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:13.734375954 CET	53	62208	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:14.789650917 CET	57574	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:14.816862106 CET	53	57574	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:15.560677052 CET	51818	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:15.596460104 CET	53	51818	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:16.248910904 CET	56628	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:16.292251110 CET	53	56628	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:17.457845926 CET	60778	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:17.485085964 CET	53	60778	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:20.056134939 CET	53799	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:20.083307981 CET	53	53799	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:21.494687080 CET	54683	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:21.531594038 CET	53	54683	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:22.015125990 CET	59329	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:22.042256117 CET	53	59329	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:22.669127941 CET	64021	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:22.704682112 CET	53	64021	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:40.696990013 CET	56129	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:40.724000931 CET	53	56129	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:41.276238918 CET	58177	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:41.303311110 CET	53	58177	8.8.8.8	192.168.2.6
Nov 27, 2020 15:25:51.543215036 CET	50700	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:25:51.580598116 CET	53	50700	8.8.8.8	192.168.2.6
Nov 27, 2020 15:26:12.316112995 CET	54069	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:26:12.343128920 CET	53	54069	8.8.8.8	192.168.2.6
Nov 27, 2020 15:26:21.706056118 CET	61178	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:26:22.053304911 CET	53	61178	8.8.8.8	192.168.2.6
Nov 27, 2020 15:26:22.377428055 CET	57017	53	192.168.2.6	8.8.8.8
Nov 27, 2020 15:26:22.532567978 CET	53	57017	8.8.8.8	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 27, 2020 15:25:11.692529917 CET	192.168.2.6	8.8.8.8	d077	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 27, 2020 15:25:16.248910904 CET	192.168.2.6	8.8.8.8	0x617	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Nov 27, 2020 15:26:21.706056118 CET	192.168.2.6	8.8.8.8	0xab5b	Standard query (0)	mail.nusatek.com	A (IP address)	IN (0x0001)
Nov 27, 2020 15:26:22.377428055 CET	192.168.2.6	8.8.8.8	0x67b	Standard query (0)	mail.nusatek.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 27, 2020 15:25:16.292251110 CET	8.8.8.8	192.168.2.6	0x617	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Nov 27, 2020 15:26:22.053304911 CET	8.8.8.8	192.168.2.6	0xab5b	No error (0)	mail.nusatek.com	nusatek.com		CNAME (Canonical name)	IN (0x0001)
Nov 27, 2020 15:26:22.053304911 CET	8.8.8.8	192.168.2.6	0xab5b	No error (0)	nusatek.com		103.6.198.43	A (IP address)	IN (0x0001)
Nov 27, 2020 15:26:22.532567978 CET	8.8.8.8	192.168.2.6	0x67b	No error (0)	mail.nusatek.com	nusatek.com		CNAME (Canonical name)	IN (0x0001)
Nov 27, 2020 15:26:22.532567978 CET	8.8.8.8	192.168.2.6	0x67b	No error (0)	nusatek.com		103.6.198.43	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 27, 2020 15:26:23.815403938 CET	587	49753	103.6.198.43	192.168.2.6	220-sambal.mschosting.com ESMTP Exim 4.93 #2 Fri, 27 Nov 2020 22:26:22 +0800 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 27, 2020 15:26:23.816065073 CET	49753	587	192.168.2.6	103.6.198.43	EHLO 468325
Nov 27, 2020 15:26:24.139399052 CET	587	49753	103.6.198.43	192.168.2.6	250-sambal.mschosting.com Hello 468325 [84.17.52.25] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Nov 27, 2020 15:26:24.140218019 CET	49753	587	192.168.2.6	103.6.198.43	STARTTLS
Nov 27, 2020 15:26:24.469810009 CET	587	49753	103.6.198.43	192.168.2.6	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: CoYUNxCu9sAz7iQ.exe PID: 4532 Parent PID: 4604

General

Start time:	15:24:25
Start date:	27/11/2020
Path:	C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe'
Imagebase:	0x210000
File size:	526848 bytes
MD5 hash:	4651A16A7A526EA71500C4E740D1B445
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.366830433.00000000036C7000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.365603212.000000000266D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.367073975.0000000003840000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 3068 Parent PID: 4532

General

Start time:	15:24:34
Start date:	27/11/2020
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\FOPVbE' /XML 'C:\Users\user\AppData\Local\Temp\tmp7077.tmp'
Imagebase:	0x13c0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3528 Parent PID: 3068

General

Start time:	15:24:35
Start date:	27/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: CoYUNxCu9sAz7iQ.exe PID: 5956 Parent PID: 4532

General

Start time:	15:24:35
Start date:	27/11/2020
Path:	C:\Users\user\Desktop\CoYUNxCu9sAz7iQ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xca0000
File size:	526848 bytes
MD5 hash:	4651A16A7A526EA71500C4E740D1B445
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.610111498.0000000003335000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.609123676.0000000003031000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.606845898.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: CoYUNxCu9sAz7iQ.exe PID: 4532 Parent PID: 4604 CoYUNxCu9sAz7iQ.exeCOMMON

Executed Functions

Function 08F188B1, Relevance: 5.8, Strings: 4, Instructions: 811COMMON

Download Yara Rule

Strings

G, xrefs: 08F18E7D
C, xrefs: 08F18A36
(, xrefs: 08F192F1
D, xrefs: 08F190AF

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: ($C$D$G
API String ID: 0-2747524572
Opcode ID: 617890dff2d0d801a9060c065fb1d9860bc0b55fe2e59ac2432f4935abfd6e9c
Instruction ID: b2230aa8ac607a7ae360da531ee4b956475640fe50d03dc4d1e390864a5c788c
Opcode Fuzzy Hash: 617890dff2d0d801a9060c065fb1d9860bc0b55fe2e59ac2432f4935abfd6e9c
Instruction Fuzzy Hash: 428200B1E45229CFDF64DF64C994BEDBBB1AB89305F5081E9C009A7291DB744AC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 08F16E35, Relevance: 2.9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

Strings

K, xrefs: 08F1712E
N, xrefs: 08F16EDF

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: K$N
API String ID: 0-3808572930
Opcode ID: 885e6ebce5c165e3fc7d7be573570a3a9460ca0790714d282eb15facf2450bc1
Instruction ID: 0fca9644889a4d1ca6f0258d497f24b1ce424522c83d9f9fbb0a3ba5b349bad7
Opcode Fuzzy Hash: 885e6ebce5c165e3fc7d7be573570a3a9460ca0790714d282eb15facf2450bc1
Instruction Fuzzy Hash: E1E115B5C09218CFDF24DF75C8847EDBAB5BB49316F10A1ADD009A7295DB384A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 08F16E7B, Relevance: 2.8, Strings: 2, Instructions: 315COMMON

Download Yara Rule

Strings

K, xrefs: 08F1712E
N, xrefs: 08F16EDF

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: K$N
API String ID: 0-3808572930
Opcode ID: dd8b3a83792d511eda01f91b7bd479525184953075d164df45a6f2e03b32fad0
Instruction ID: 060c3aa8939a5f8392b43f8d218286806730fa7111eb108b66bafd84bc814d0d
Opcode Fuzzy Hash: dd8b3a83792d511eda01f91b7bd479525184953075d164df45a6f2e03b32fad0
Instruction Fuzzy Hash: DDC126B5C09218CFDF24EF74C8887ADBBB5BB89316F2051ADD009A7295DB344A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 08F17361, Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

K, xrefs: 08F1712E
N, xrefs: 08F16EDF

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: K$N
API String ID: 0-3808572930
Opcode ID: e4a718a0b9baa231e4a3c2e86ffa4cfa2260bc1e572a7d3093285715d520b6b0
Instruction ID: 250e8864f0234c3fd1037e8ec76722497a722652da16719a1a52fafc25654d99
Opcode Fuzzy Hash: e4a718a0b9baa231e4a3c2e86ffa4cfa2260bc1e572a7d3093285715d520b6b0
Instruction Fuzzy Hash: 61B114B4C05228CFDF24EF79D8847ADBAB5BB89316F2061ADD009A7295DB344A85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 08F15711, Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

N, xrefs: 08F15768
L, xrefs: 08F15470

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: L$N
API String ID: 0-3863814279
Opcode ID: bf317dab04cf0aba6a162bdf9aedcea2f6bc664c2619d869fde283cd599631ae
Instruction ID: b26dd7d9e8cf60317a190896b1ec7ab413d1caf37a32378c035cd287b75b5cac
Opcode Fuzzy Hash: bf317dab04cf0aba6a162bdf9aedcea2f6bc664c2619d869fde283cd599631ae
Instruction Fuzzy Hash: C9A114B9D09218CFCF04CFE8C4846EEBBB6BB8D31AF249119D419AB295D7349845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B681, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00C9B6F0
GetCurrentThread.KERNEL32 ref: 00C9B72D
GetCurrentProcess.KERNEL32 ref: 00C9B76A
GetCurrentThreadId.KERNEL32 ref: 00C9B7C3

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0bfc546051b212a068c44007600667487e4d0be20c220af5cc6d87572820c755
Instruction ID: 8ee7f808ecca8855b48e174ea14f3cce52078a7126292647d3577e22caa21c6d
Opcode Fuzzy Hash: 0bfc546051b212a068c44007600667487e4d0be20c220af5cc6d87572820c755
Instruction Fuzzy Hash: 935184B0D006889FDB54CFA9D688BDEBFF1AF88304F248559E019A7291C7706D84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00C9B6F0
GetCurrentThread.KERNEL32 ref: 00C9B72D
GetCurrentProcess.KERNEL32 ref: 00C9B76A
GetCurrentThreadId.KERNEL32 ref: 00C9B7C3

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: acf2b051ef087b988c3e8ceb2ab9af0561a8f0d68402b156b3d8665f20b014b7
Instruction ID: 80841a1736f9cc65f3e48ceda38ee8a2449ee23af8ab090a323835afaefc71f8
Opcode Fuzzy Hash: acf2b051ef087b988c3e8ceb2ab9af0561a8f0d68402b156b3d8665f20b014b7
Instruction Fuzzy Hash: A45164B0D006489FDB54CFAAD688BDEBBF1AF88304F248559E419A7390C7746D84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F19764, Relevance: 1.6, APIs: 1, Instructions: 147processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 08F198C3

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cef548a9a8e30e130f35df93bd682a1e41445685c9234f4f08026c89c22e862f
Instruction ID: 490acb3330ca399d4d1eb062354333336ceccc07a540227c1747cff930703ce0
Opcode Fuzzy Hash: cef548a9a8e30e130f35df93bd682a1e41445685c9234f4f08026c89c22e862f
Instruction Fuzzy Hash: DF510771D00329DFDF10CF99C880BDDBBB2AF88314F5581A9E808A7250DB755A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08F19770, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 08F198C3

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 87b1bc15b3b69152e46662fcded9c93822cab074a4c10084505299a41f479798
Instruction ID: 322fec7c777e8c95f6c92f4adc7c53094922457f7354f5755ad329b3a257c61e
Opcode Fuzzy Hash: 87b1bc15b3b69152e46662fcded9c93822cab074a4c10084505299a41f479798
Instruction Fuzzy Hash: B5510671D00329DFDF10CF99C880BDDBBB6AF48314F5580A9E408A7250DB755A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FCEC, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C9FE0A

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 57b2c3955e14ae55f55f7f98e8884e47da639831437a85e45b2d51ec6cafb727
Instruction ID: 7c1bc8fdedd1388587baadaa44ea786d6f087319a646edd6580b62c857715a9a
Opcode Fuzzy Hash: 57b2c3955e14ae55f55f7f98e8884e47da639831437a85e45b2d51ec6cafb727
Instruction Fuzzy Hash: 3551BFB1D002499FDF14CF99C884ADEBFB1BF88314F25812EE819AB211D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C9FE0A

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dbaf4f323e4175ab03a485aac9eddefbc0ea036a5d69616438d724571bb2012a
Instruction ID: 87da1db47c9723cc5a7ed842044f528e8fa4682358a89947c8bb266d3a590754
Opcode Fuzzy Hash: dbaf4f323e4175ab03a485aac9eddefbc0ea036a5d69616438d724571bb2012a
Instruction Fuzzy Hash: D7419EB1D003499FDF14CF99C884ADEBBB5BF88314F25812EE819AB211D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C95364, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C95421

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5c632314b5ea8c7d1384c11227f73f62675cf6f6ec6366950be30b5444ad17a0
Instruction ID: 94a2c97b57cd8acef75cbc46c951630c5060872d3ede1abc7e8e410a7aec964e
Opcode Fuzzy Hash: 5c632314b5ea8c7d1384c11227f73f62675cf6f6ec6366950be30b5444ad17a0
Instruction Fuzzy Hash: A1413570C00618CFDF25CFA9C8887DEBBB1BF89308F25846AD409AB251D775598ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C93DE8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00C95421

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 85faeb72b87a32404ec81a088a4d419a3051174bb43526c13453ea670bb27f28
Instruction ID: 91827bb76a06ebedc389135ffd6f2a53d3fd31f3d140b428c657dfeaef26911a
Opcode Fuzzy Hash: 85faeb72b87a32404ec81a088a4d419a3051174bb43526c13453ea670bb27f28
Instruction Fuzzy Hash: A441E270C00618CFDF24DFA9C988BCEBBB5BF49304F218469D409AB251DBB56989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08F1A690, Relevance: 1.6, APIs: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08F1A65D

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8dce7f1df6e6348bc2d7e52e3cdd431779d940936bf11dbe53b9f011dd7279ad
Instruction ID: cd37c29bf60a2c5b8348fa7b49f565962f440eb74b05127c23fefe45d421a489
Opcode Fuzzy Hash: 8dce7f1df6e6348bc2d7e52e3cdd431779d940936bf11dbe53b9f011dd7279ad
Instruction Fuzzy Hash: 493178B1D022298FCF20CFA9C844BEEBBF4AF48311F118019D800B7241E779AA05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08F19A70, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08F19AF7

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c134db4e9f21195f460519d7eef48e3a196c9c3bda5f7938757fb9be3bf857a0
Instruction ID: a5471e6c7e9e00cf51a28d1a42d47c703809e1d84dacfb5c656d0a5aa7a9fdc9
Opcode Fuzzy Hash: c134db4e9f21195f460519d7eef48e3a196c9c3bda5f7938757fb9be3bf857a0
Instruction Fuzzy Hash: 1021F3B6E002499FCF10CFAAD880ADEBBF4FB48320F14802AE558A3210D374A555DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19BF0, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08F19C7D

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6d30008a705976db14bc1b07b435aa0ba436836771a3f40b10b5b9c7e349dabf
Instruction ID: 0f6241f14c50fef18ec3eb9d12051aa9c463dc02219ef3bb91d5b10c3f524431
Opcode Fuzzy Hash: 6d30008a705976db14bc1b07b435aa0ba436836771a3f40b10b5b9c7e349dabf
Instruction Fuzzy Hash: 8C21E3B1A002599FDF10CFA9C885BDEBBF4FF48310F54842AE958A7250D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19BEE, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08F19C7D

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f2f9e53a737aa953925a8c2fb7c7dc080607d5d042b54e3e0f2d57f8c160bb5d
Instruction ID: 2595804850e4033023d82d619cf9aef164325c541e2eed2f7e0e4a7a7a9cd571
Opcode Fuzzy Hash: f2f9e53a737aa953925a8c2fb7c7dc080607d5d042b54e3e0f2d57f8c160bb5d
Instruction Fuzzy Hash: 8621F2B1A002499FCF10CFA9C884BDEBBF4BF48310F14852AE859A7250D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B8B2, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C9B93F

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8554da5aedf260aa2f81b22b689a259f7928db7f027e371bf66096f1d44c9633
Instruction ID: 6776681af92f2ff11b6d0cdf9f91f80255ba00af36a1aa0872def1d8bc44472c
Opcode Fuzzy Hash: 8554da5aedf260aa2f81b22b689a259f7928db7f027e371bf66096f1d44c9633
Instruction Fuzzy Hash: B921E0B5D00259AFDF10CFA9D984AEEBFF4EF48324F15801AE954A7211C374AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C9B8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C9B93F

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 96912cc90313ea9ca6971f12370ebfdd6c44460ddc7d90af3267a54d487b1811
Instruction ID: 9b03961a953f8f78deabdcfc8ceded9140898c1290057f776984c1530a95981b
Opcode Fuzzy Hash: 96912cc90313ea9ca6971f12370ebfdd6c44460ddc7d90af3267a54d487b1811
Instruction Fuzzy Hash: F321E2B5D00258AFDF10CFA9D984ADEBBF8EF48324F15801AE954A7310D374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F199B4, Relevance: 1.6, APIs: 1, Instructions: 59threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 08F19A2F

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ac967b1fcfb6ee4a3cf2845d194625f8359b72db3a429b975a43632db7f2719e
Instruction ID: 4a792b17e1b6d4a57ce53c19b54a519b0681ab35e0d34a8339eac68bb30c06bf
Opcode Fuzzy Hash: ac967b1fcfb6ee4a3cf2845d194625f8359b72db3a429b975a43632db7f2719e
Instruction Fuzzy Hash: 0021F7B1E006599FCB10CFAAC4857EEFBF4BB48314F55812AD458B7640D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19A78, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08F19AF7

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b9dc811816788fdda55e981d6237cce3abd1898abf8ae2c4d2a82679cf6a39bc
Instruction ID: e4400170ca0c0bf45e2d32f285e2cd0fb71727c6a89b80cade7ef38b1afabb89
Opcode Fuzzy Hash: b9dc811816788fdda55e981d6237cce3abd1898abf8ae2c4d2a82679cf6a39bc
Instruction Fuzzy Hash: 1A21D0B19002599FCB10CF9AD884BDEBBF4FF48320F54842AE958A7250D374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F199B8, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 08F19A2F

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 3fa37f5edd55e21b25622840e56d6147b23f973b42f0ae081d751f78e5b4a43a
Instruction ID: 16930d223a9935ce018b30b6cbc3a7581c701a94e3a3e94f8b4bf93e6e6fce09
Opcode Fuzzy Hash: 3fa37f5edd55e21b25622840e56d6147b23f973b42f0ae081d751f78e5b4a43a
Instruction Fuzzy Hash: DC2106B1E006199FCB00CFAAC8857DEFBF4BB48224F55812AD418B3640D778A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C99AF0, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C99951,00000800,00000000,00000000), ref: 00C99B62

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 49fba7e2221ca41ecd063fe57ee1e7d09867397f9e7c0cefe63d8298481cdb6c
Instruction ID: f8e008a7afbaaefcbd8b2c7729993efe307afb2600f9ea03e2e492ec2c88601a
Opcode Fuzzy Hash: 49fba7e2221ca41ecd063fe57ee1e7d09867397f9e7c0cefe63d8298481cdb6c
Instruction Fuzzy Hash: 0B11F7B2D002488FCF20CF99D444AEEBBF4EF88324F15851ED455A7600C7759945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C99478, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C99951,00000800,00000000,00000000), ref: 00C99B62

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6b4ac20daf4232a2466f9e251db781c63c96bd92731401e95f4d2bbbf47176ee
Instruction ID: a19108eced2ce27fda055f7dbe76e76fdbd38a0a48ea3a180e30277a8743aae1
Opcode Fuzzy Hash: 6b4ac20daf4232a2466f9e251db781c63c96bd92731401e95f4d2bbbf47176ee
Instruction Fuzzy Hash: 311106B1D002498FDB14CF9AD448ADEFBF4EB48320F15851ED515A7600C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19B40, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08F19BB3

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2dccbe9a9fedbeddbab6f8f899bce2e6b04fac38b95553095f4eb76a813ad304
Instruction ID: 293400699690631807486cea50150046031305d2a2fd20b7f8de9dbeae9165d6
Opcode Fuzzy Hash: 2dccbe9a9fedbeddbab6f8f899bce2e6b04fac38b95553095f4eb76a813ad304
Instruction Fuzzy Hash: A811E2B59002489FCF10CF99C884BDEBFF4AF49324F148459E559A7210C775AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19CC0, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08F19D27

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0fb9ee37a3a491686882df5c7204c022cc121b72484523d1e9aeadd698cbb869
Instruction ID: 728f298b5b9b24ec2bddf3557d2520e3db2a0ae6c6898a0328a416faa7a5a86c
Opcode Fuzzy Hash: 0fb9ee37a3a491686882df5c7204c022cc121b72484523d1e9aeadd698cbb869
Instruction Fuzzy Hash: 651102B59002498FCB10CFA9D484BDEBFF4EF48324F24845AD559A7201D3B4A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C99869, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C998D6

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aac05fe8e32f62754e22a4ff620498b5c829390eb5c42b8389abc672be2c7bd6
Instruction ID: c2fdfe83bdd152ce4899301a1a50ec157797632d2ce768e8007857b9eaa68bf7
Opcode Fuzzy Hash: aac05fe8e32f62754e22a4ff620498b5c829390eb5c42b8389abc672be2c7bd6
Instruction Fuzzy Hash: 501120B1C006498BDB10CF9AC448BDEFBF4EF89320F05841AD869A7600C375A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19B48, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08F19BB3

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 044e5494b42d2dbf6c2eb8b203b029418ca1467f013a3d5e9d4f6573458e0d00
Instruction ID: c5c9c26af1fc3969f7136a5b4210ef13137570eaf30f6ced92884fae15a36e1f
Opcode Fuzzy Hash: 044e5494b42d2dbf6c2eb8b203b029418ca1467f013a3d5e9d4f6573458e0d00
Instruction Fuzzy Hash: 9411E0B59002499FCB10CF9AC884BDEBFF8FF48324F148419E569A7250C775AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C99870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C998D6

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 497b0a8dcf1dd830d7028ff72b281a849b875672badf7144c18dfe7996b0145d
Instruction ID: 914e915585152eadc20bed68473114186791c290335adb540a2af9f1f5872437
Opcode Fuzzy Hash: 497b0a8dcf1dd830d7028ff72b281a849b875672badf7144c18dfe7996b0145d
Instruction Fuzzy Hash: 9C11FDB1C002498BDB10CF9AC448ADEBBF4EF89324F15842AD429A7610C374A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F1A5F9, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08F1A65D

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 45b77351bfde31dbf6625efe78603b251c75337546aed63fe09512d8146e1ca4
Instruction ID: dbbeb47c7f7e5d156e20ad03296c572820691d484e7cec6cd97f2bec36888b46
Opcode Fuzzy Hash: 45b77351bfde31dbf6625efe78603b251c75337546aed63fe09512d8146e1ca4
Instruction Fuzzy Hash: 4A1103B58002599FCB10CFA9D888BDEBFF4EB48324F14841AE459A7601D3B4A985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F14B68, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08F1A65D

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dd8fde3baa7f85bac39e2b7e8b700f72f58931e58646bd4bddd41635a686ec4f
Instruction ID: 5678200b56611eca5abdb5c675d336b1a795443a0327e569d6b22dd86eef7eac
Opcode Fuzzy Hash: dd8fde3baa7f85bac39e2b7e8b700f72f58931e58646bd4bddd41635a686ec4f
Instruction Fuzzy Hash: 891103B58003599FCB10DF99C984BDEBBF8EB48320F15841AE955A7200D374A994CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FF38, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C9FF9D

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: edb152c47afca8166e0a8857ad913c3742ed1e59272ac4cf43accbeedececc55
Instruction ID: a510744593a96a14b526779d729a1f1f1aaeb3cd70e0772952de530e54f73fb1
Opcode Fuzzy Hash: edb152c47afca8166e0a8857ad913c3742ed1e59272ac4cf43accbeedececc55
Instruction Fuzzy Hash: 711122B58006498FDB10CF99D589BDEFBF4EF48320F11851AE818A3640C374AA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C9FF40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C9FF9D

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7b9b6bc55fb2cf7ba56907cd12e046b395a91dfeb12a57b29af206e910e6ca56
Instruction ID: f6e1e5f143ce35b6ae5f64f651752f66132b80575e608f8af52fc30ef657f934
Opcode Fuzzy Hash: 7b9b6bc55fb2cf7ba56907cd12e046b395a91dfeb12a57b29af206e910e6ca56
Instruction Fuzzy Hash: 191123B58002488FDB10CF99D588BDEFBF8EF48324F14841AE858A7340C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F19CC8, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08F19D27

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 28b6abf380e566aab11ea76b6ed04755385fc21a8cdd9b96b7db2bfd2ed912e1
Instruction ID: 06660dbd64cb747417870df5c2b24958c703fac2e7abd4e889baf628d373053e
Opcode Fuzzy Hash: 28b6abf380e566aab11ea76b6ed04755385fc21a8cdd9b96b7db2bfd2ed912e1
Instruction Fuzzy Hash: D1111EB1D002488FCB10CF9AD884BDEFBF8EF48324F24841AD458A7200C7B4AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365187660.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fe3173150053d80a539b956f69b34f25806a62e1a50a2d1c60a5d2f79ccabb
Instruction ID: e21260a7deac7709610a8415252ed2d8f952ca358897e6707f047cbe822c276d
Opcode Fuzzy Hash: 66fe3173150053d80a539b956f69b34f25806a62e1a50a2d1c60a5d2f79ccabb
Instruction Fuzzy Hash: 8C21F571504240DFDB15CF54D5C0B16BBA5FB88315F24CAEDDC094B242C777D84ACA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365187660.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209723bbd96a7fb1ea79ae0dada7e25810fa1d752b5e44ec0013b587c5e58311
Instruction ID: cff47ddd551a4fa581b6b4d7c0c0ff7f582cd8580181f0fd4931c6825245f991
Opcode Fuzzy Hash: 209723bbd96a7fb1ea79ae0dada7e25810fa1d752b5e44ec0013b587c5e58311
Instruction Fuzzy Hash: 8821F271504240DFDB24DF14D9D4B16BBA5FB88325F28CAE9DC094B286C33AD84BCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D005, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365187660.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8147ebdcac1dcddd1f90f9a2ec0c53378c94153d773d3a5b93f1b5aa1530c1
Instruction ID: 2721dca60dae00224c6eb035f1293682fb384cf8032b89bf8493799439b4f4fb
Opcode Fuzzy Hash: 2b8147ebdcac1dcddd1f90f9a2ec0c53378c94153d773d3a5b93f1b5aa1530c1
Instruction Fuzzy Hash: 592187755093C08FDB16CF20D5A4B15BF71EB46314F28C6DAD8498B697C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365187660.0000000000B5D000.00000040.00000001.sdmp, Offset: 00B5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56df88b9b7a1166935ae8fa4ca7bf63e7314e17cb226e706ca627439ff04c8a
Instruction ID: b2cb113ccd6e0a114978732aa68a334a4aa958b8e6a1af71080c29fa025460e0
Opcode Fuzzy Hash: d56df88b9b7a1166935ae8fa4ca7bf63e7314e17cb226e706ca627439ff04c8a
Instruction Fuzzy Hash: 03117975904280DFDB55CF10D5C4B15BBA1FB84324F28C6E9DC494B656C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 08F12FFC, Relevance: 3.0, Strings: 1, Instructions: 1797COMMON

Download Yara Rule

Strings

2#,, xrefs: 08F147D4

Memory Dump Source

Source File: 00000000.00000002.382119713.0000000008F10000.00000040.00000001.sdmp, Offset: 08F10000, based on PE: false

Similarity

API ID:
String ID: 2#,
API String ID: 0-2160143114
Opcode ID: c4acf7eef646972096a7020b1fa84953244f8f603100178987589f16e8644672
Instruction ID: d5e8c51308ed5ea85d686fbc2870048ec9427a2d1bb66b95f31d73468bdaed4f
Opcode Fuzzy Hash: c4acf7eef646972096a7020b1fa84953244f8f603100178987589f16e8644672
Instruction Fuzzy Hash: 77039D7A600514AFDB169F94C944E95BBB2FF4D318F0A80D4E60A9F276C736E861EF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C9E570, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523cd42cca5048a9910efb041caa76d847c982cefc9f614b4fb7943e69353457
Instruction ID: 0e0082c63fd4cb5c2727e35313349bc0abfa65eba6819c67d68b650e9524bf18
Opcode Fuzzy Hash: 523cd42cca5048a9910efb041caa76d847c982cefc9f614b4fb7943e69353457
Instruction Fuzzy Hash: 8612AEB1811F468BE711DF65EC983AD7BA1B745328F904308D2613BAF0D7B9118AEF84

Uniqueness

Uniqueness Score: -1.00%

Function 00C9C124, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b21df8d1eda5127ce7fec6c37140d66580426685463501a8fc436960aee4f49
Instruction ID: 3fb795d4c76038b465ba611c8f149072ce48b8549d7ce0f2362e1341ed1a9474
Opcode Fuzzy Hash: 6b21df8d1eda5127ce7fec6c37140d66580426685463501a8fc436960aee4f49
Instruction Fuzzy Hash: 64A18032E00219CFCF15DFB5C8885DEBBB2FF85300B15856AE816BB261DB71A955DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C9E562, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.365306394.0000000000C90000.00000040.00000001.sdmp, Offset: 00C90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1322af61624482cc6c2586f640c48e56826b258c2c596e80f7c278076aaa4a
Instruction ID: 691a8b936bf40457df1ee3fba153bab1a4883f43cebd5e4f52bf454569e4fa2b
Opcode Fuzzy Hash: ef1322af61624482cc6c2586f640c48e56826b258c2c596e80f7c278076aaa4a
Instruction Fuzzy Hash: 8FC114B1911B468BD711DF65EC883AD7BB1BB85328F614308D2617BAF0D7B8148ADF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CoYUNxCu9sAz7iQ.exe PID: 5956 Parent PID: 4532 CoYUNxCu9sAz7iQ.exeCOMMON

Executed Functions

Function 0136B990, Relevance: 5.5, Strings: 4, Instructions: 494COMMON

Download Yara Rule

Strings

\, xrefs: 0136BAD9
\, xrefs: 0136BBCE
\, xrefs: 0136BA09
\, xrefs: 0136BB93

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID: \$\$\$\
API String ID: 0-3238275731
Opcode ID: 883a933e791c6e59dfe6ef923f8589f161418465c07e48d81c9831c8c936d0a6
Instruction ID: 8e3417c9488164e6de85ddb8aaab54bcf305160db535e5134f61006726cf46a6
Opcode Fuzzy Hash: 883a933e791c6e59dfe6ef923f8589f161418465c07e48d81c9831c8c936d0a6
Instruction Fuzzy Hash: 2D02D131B002158BDB24DB78D8447AEBBBAAF84318F15C529D51AEB39DDB34EC458B90

Uniqueness

Uniqueness Score: -1.00%

Function 01351524, Relevance: 2.0, APIs: 1, Instructions: 502libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01351878

Memory Dump Source

Source File: 00000003.00000002.608205555.0000000001350000.00000040.00000001.sdmp, Offset: 01350000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d5347d8708fa2d1ae55b6110ab5b51b352332bfe3b61298e9db0bbd71ca8f30f
Instruction ID: 7dd976ebcd230ae86a4b906b80a9cdf2bcbb64918dc22dfe1c4786c8cb8710f3
Opcode Fuzzy Hash: d5347d8708fa2d1ae55b6110ab5b51b352332bfe3b61298e9db0bbd71ca8f30f
Instruction Fuzzy Hash: FC123A35E006188FCB64EFB8C854A9EB7F6AF89704F1085ADD40AAB755EF309D45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0157D5A8, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 0157FCB3

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 134451766046d8e43dfa48419fa8f6aafa1df91c47beea9e7c5bcbafecb279cc
Instruction ID: a3def84f5bbc143ac303eb52f279be14c105a7884dfaa51acbf520dfd5f9944c
Opcode Fuzzy Hash: 134451766046d8e43dfa48419fa8f6aafa1df91c47beea9e7c5bcbafecb279cc
Instruction Fuzzy Hash: 5F2134719042088FCB54CF99D844BEEBBF9FB88314F10882AE419A7750CB74A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01362D50, Relevance: .9, Instructions: 892COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dec7c6e94892721a50598aa2b8f50fc69c654d3b323597482c064519eea87eb
Instruction ID: 3c0ae80fd7eae8527e28698394b8b17d7fe77cf398cde86f54acb5dea15512c1
Opcode Fuzzy Hash: 4dec7c6e94892721a50598aa2b8f50fc69c654d3b323597482c064519eea87eb
Instruction Fuzzy Hash: C0824930A00219DFCB15CF68C984AAEBBFAFF49318F15C559E50A9B2A5C730ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01361FE0, Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6c66c13a9d818828ed8db50b3c9f4012b42199f7ae62643f3962ee734d773d
Instruction ID: 78e87fd760ac1a413eaf32525bf448b23f7c156f6d990b4fd814e18621d84c1b
Opcode Fuzzy Hash: ac6c66c13a9d818828ed8db50b3c9f4012b42199f7ae62643f3962ee734d773d
Instruction Fuzzy Hash: 6A129E71A002198FDB14DFA8C854BAEBBFABF88308F158569E906DB355DB34DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0136CAA8, Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abe6382189c2c3c4c1da9abdaea8a4b8b01b4313475b965f1f55103cf636e88
Instruction ID: dd8d4d55f519ab2d00be5d0d2c5166437e3b268a783a07ff3df2035db41afc30
Opcode Fuzzy Hash: 5abe6382189c2c3c4c1da9abdaea8a4b8b01b4313475b965f1f55103cf636e88
Instruction Fuzzy Hash: 5FD1A271B002055BDB24ABB9985876EBAE6AFC5308F15C829E50ADF3C4DF74DC0687D1

Uniqueness

Uniqueness Score: -1.00%

Function 01362768, Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac994227d22c61db80bee595025d8a66c36d581234eec0762862dcb78aa5fe3d
Instruction ID: 53fa1aa61a00e1fe96bb9f51477d3c283fdc664fb7878d9829b87132b30ab0cd
Opcode Fuzzy Hash: ac994227d22c61db80bee595025d8a66c36d581234eec0762862dcb78aa5fe3d
Instruction Fuzzy Hash: F7E10C31A00119CFDB15CFA9C984AAEBBFAFF88358F16C055E905AB265DB70DC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0157EC08, Relevance: 1.8, APIs: 1, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c605df15f633b943cda08e131378f6dd51364945b0943e01f2adf67e9fcc8e
Instruction ID: 24ce8db4a19d4dad01661d777248ddb02c9542be2c0be327736e5d2c17997942
Opcode Fuzzy Hash: 90c605df15f633b943cda08e131378f6dd51364945b0943e01f2adf67e9fcc8e
Instruction Fuzzy Hash: 07A10471A043448FC7029B79E85A69ABFF5FF86220F1584EBE505DF262DA349C05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157A378, Relevance: 1.7, APIs: 1, Instructions: 236libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0157A5A9

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe0f47851702fdd3a4cca4417cb2ad4111480d75182d7df3a8572a6e273bee42
Instruction ID: d74764cabfe3259127552c07c5b61371340f672457e5f2941ce5c386507daae2
Opcode Fuzzy Hash: fe0f47851702fdd3a4cca4417cb2ad4111480d75182d7df3a8572a6e273bee42
Instruction Fuzzy Hash: 4681A1306043859FD7128B78D859AAE7BB6FF82304F1984BAD444DF292DA39DC0ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0157CBD8, Relevance: 1.7, APIs: 1, Instructions: 196libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0157CCCF

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c93f899f763c6413b9bf7e988aed3f0ace0ab5222ad46b6a50502e29f58a6bc
Instruction ID: e06df3de97da3bc6f595f927154fdcb80d61288b74c4b379354244c6dc7cdd7c
Opcode Fuzzy Hash: 9c93f899f763c6413b9bf7e988aed3f0ace0ab5222ad46b6a50502e29f58a6bc
Instruction Fuzzy Hash: 6861C031B002469FCB14EBB4D859AAE77FABF84204F15896AD506DF391EB34EC05C791

Uniqueness

Uniqueness Score: -1.00%

Function 0157A568, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0157A5A9

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 19f9df45aea5743ea94d9c332a80a4ab06ada489226a0c729d8b1490c8684292
Instruction ID: 23cf9ec28b6e0bd3590ed1c7555d5d75ffb61186224e16c63014694d7c29c517
Opcode Fuzzy Hash: 19f9df45aea5743ea94d9c332a80a4ab06ada489226a0c729d8b1490c8684292
Instruction Fuzzy Hash: F2614030A10219DBDB14EFB8E459BAEBBF6BF84304F148829D406AB394DF759C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01577DF9, Relevance: 1.6, APIs: 1, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01577F11

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fc4adadcfe91300155663d5dc03a17e626d779e944ffec81ecc653fde08a977f
Instruction ID: ba9c8bce21d02b765c6c3cd09796b5ce70eab17002b43a271ed468d3940ad057
Opcode Fuzzy Hash: fc4adadcfe91300155663d5dc03a17e626d779e944ffec81ecc653fde08a977f
Instruction Fuzzy Hash: 674114B1E00258DFCB10CFA9D989A9EBBF5BF48710F15846AE818AB355D7749809CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01577B41, Relevance: 1.6, APIs: 1, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 01577C54

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 263add57df399b06e50546eec9219d8972b5a7b28b0387818cdfb1961b55c64a
Instruction ID: 3c04a72a002d26f2fbb04f36f68d79ee3edc685db011993e8401adfff8530728
Opcode Fuzzy Hash: 263add57df399b06e50546eec9219d8972b5a7b28b0387818cdfb1961b55c64a
Instruction Fuzzy Hash: 8E4162B0E043498FCB00CFA8D588A9EFFF5BF89314F29816AE408AB351D7759945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01365B20, Relevance: 1.6, Instructions: 1600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5327d4ccdcd32ec2672b3f1b120cbe2dd03d3d77db7b24f758b2fc9138d783
Instruction ID: 1a21c51471de776e1880089c66761a1375054c0fc532052fd121d26ff4b0c1d4
Opcode Fuzzy Hash: cc5327d4ccdcd32ec2672b3f1b120cbe2dd03d3d77db7b24f758b2fc9138d783
Instruction Fuzzy Hash: 93C2DF73D163118FC7A18F64C49A089BB75FF52378B7984AEE8810B215F7345E02EB96

Uniqueness

Uniqueness Score: -1.00%

Function 015720EC, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 01577F11

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f2c57a5620a78cfd7410f7913d03a5669ca1cd01ffed144c5d95e7c5d4b1c868
Instruction ID: d99fa3860a869cdd1a306bc748abdfac03a79466466a368f8079ce767ba82f36
Opcode Fuzzy Hash: f2c57a5620a78cfd7410f7913d03a5669ca1cd01ffed144c5d95e7c5d4b1c868
Instruction Fuzzy Hash: B231D1B1D00258DFCB20CFAAE984A9EBFF5BF48710F55852AE819AB314D7709905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015720E0, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 01577C54

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8e34fc007c5305efe344062ff989587d22328e17fc96856e44f8fb030d1ae79e
Instruction ID: fa539bc720eee8f7bd5fb7e3f5131c92fb01d97266cbfa1240dac3f86a3aa862
Opcode Fuzzy Hash: 8e34fc007c5305efe344062ff989587d22328e17fc96856e44f8fb030d1ae79e
Instruction Fuzzy Hash: A33110B0D002488FDB10CF99D588A9EFFF5BF48314F29856AE809AB341C7759884CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0157EEE8, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0157EE6A), ref: 0157EF57

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8f681ca63ba9e2d0795641b4017e77a8e1643edc26bc024762652e5052ebbd7f
Instruction ID: dc74a164794916dd5fdc53270c3882bb2ca39cc80a56b194bd87fba873f34f18
Opcode Fuzzy Hash: 8f681ca63ba9e2d0795641b4017e77a8e1643edc26bc024762652e5052ebbd7f
Instruction Fuzzy Hash: 522132B1C046598FCB10CFAAD445ADEFBF4FF49324F15859AD828A7601D778AA04CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157FC30, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 0157FCB3

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 4435d4dc8610225dea56a115a68906d84fcb6db23317126e3ad3612df1e03860
Instruction ID: 022c85bc76f893b679e9df7b79917b7864722e07f759f9a9ee31d79f0a0a0060
Opcode Fuzzy Hash: 4435d4dc8610225dea56a115a68906d84fcb6db23317126e3ad3612df1e03860
Instruction Fuzzy Hash: BD2123B5D002098FCB54CF99D944BEEBBF5BF88314F14882AE419A7650CB74A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157D560, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0157EE6A), ref: 0157EF57

Memory Dump Source

Source File: 00000003.00000002.608649820.0000000001570000.00000040.00000001.sdmp, Offset: 01570000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fc0315cd1b4be384f255a3cda5d8ce29ddfd42ff3113ac1e4ad8973ef2c66e81
Instruction ID: d72d451bc77fbd4bc15bd6d5404398777993f814fd5f76bdee4a3e2333cb0109
Opcode Fuzzy Hash: fc0315cd1b4be384f255a3cda5d8ce29ddfd42ff3113ac1e4ad8973ef2c66e81
Instruction Fuzzy Hash: DE112FB1D006199BCB10CF9AD445BAEBBF4FB48224F05856AE828B7600D778A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0136B8E0, Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

\, xrefs: 0136BA09

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 8a93d3fe4fded086be71cc44588527b8df124a4c5e7bcee5d865ddb865e0c426
Instruction ID: 4eb407a1c4807bbe6d541d543e94cc8be2b06701350ae9af3d5435b17142742c
Opcode Fuzzy Hash: 8a93d3fe4fded086be71cc44588527b8df124a4c5e7bcee5d865ddb865e0c426
Instruction Fuzzy Hash: B741D631B042858FD706CB7888146FEBFF9AF86208F14C0ABD508DB29AE7749D058B91

Uniqueness

Uniqueness Score: -1.00%

Function 0136CFD1, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

P@)l, xrefs: 0136D057

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID: P@)l
API String ID: 0-2593255398
Opcode ID: ea86fed2442ce2d9c710681a483082ad72cb03fa6dbdb57b977940f86c1112d0
Instruction ID: 292d2f1c4c18743043c493c8c0540ef3bed6ce6ce0f1b2f4475319c9e056e062
Opcode Fuzzy Hash: ea86fed2442ce2d9c710681a483082ad72cb03fa6dbdb57b977940f86c1112d0
Instruction Fuzzy Hash: FC31C231B042048FDB14AFB9D4186AEBBFAAF88208B15846DD546DB755DF34DC06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0136CFE0, Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

P@)l, xrefs: 0136D057

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID: P@)l
API String ID: 0-2593255398
Opcode ID: dafd2c9813b4698584e3e39f752861c3b9b0e09eacd02ef02f8f96bf2073b1d7
Instruction ID: ee33afcc5c7bf7991cb25ccb98ae934738ef969d203d9be02e5eb04bf7cb384c
Opcode Fuzzy Hash: dafd2c9813b4698584e3e39f752861c3b9b0e09eacd02ef02f8f96bf2073b1d7
Instruction Fuzzy Hash: 3631A231B002048FDB14ABB9D4186AEBBFAAF88244F15846DD806DB795DF34DC46CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0136AF70, Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d4dd31221b645a28943e49aaeaff452dcf868e440a2f08c4ee59df8ce89e3a
Instruction ID: a518541b95224c8f53271fe5a65332143c0c3731026154a01412f092be5017ac
Opcode Fuzzy Hash: 85d4dd31221b645a28943e49aaeaff452dcf868e440a2f08c4ee59df8ce89e3a
Instruction Fuzzy Hash: C5223C34A00204CFCB25DBB8D8586ADBBBAFF89319F248469E505EB359DB359C45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013643A9, Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9727e22f2ff0350de5da582680adb82cd5ece0b5a931f3d7c358c32d488019a
Instruction ID: df0f4a44ea00bf6706f24d92bf72fff6c16fb28f9cf91717aa28d571c492c382
Opcode Fuzzy Hash: b9727e22f2ff0350de5da582680adb82cd5ece0b5a931f3d7c358c32d488019a
Instruction Fuzzy Hash: 9A224E74A0011D8FEB24DFA4D850BEEBBB6EF95308F1080A9C60A6B395DB355D41DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0136C6DA, Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce055b180b329f5c9aff01ae964faed53856b27eb745f493f3b8dde66c5dc4b
Instruction ID: 780cd602684b4fa4a29cebaa1730e2412087c0a1274938c871df8e244f46a0aa
Opcode Fuzzy Hash: cce055b180b329f5c9aff01ae964faed53856b27eb745f493f3b8dde66c5dc4b
Instruction Fuzzy Hash: 3CE16D30B0D3C54FD757977888646A63FB59F87214F1A84EBD084CF2A7E6698C0AC712

Uniqueness

Uniqueness Score: -1.00%

Function 0136D5C8, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9644e5bb5cace8bf96ca8532285fd772302573bb3b5ce0b323eab61436937ff1
Instruction ID: 3d129335cc9839592157bbc44fd323715c2332b28cc406f7c76c46a10815e954
Opcode Fuzzy Hash: 9644e5bb5cace8bf96ca8532285fd772302573bb3b5ce0b323eab61436937ff1
Instruction Fuzzy Hash: 2AC1F371B002458FCB15CFACC8546BE7BFAAF85308F08C46AD146DB656DA38DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0136DA80, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a432ad4df344455bfe78fda14b2baa99371eee352e4126862f552099ffd36397
Instruction ID: 7896c72b54042c82a2b952ee860ca9014bb98839ff4b75d1902314b41edb15c4
Opcode Fuzzy Hash: a432ad4df344455bfe78fda14b2baa99371eee352e4126862f552099ffd36397
Instruction Fuzzy Hash: BAB102307042098FDB159BB8C85467A7FBAEF85218F19C46AD582CB7AACF78CC41C795

Uniqueness

Uniqueness Score: -1.00%

Function 01362D40, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6134646c71f7b2b0e13aabe89da7a164b605fd00716a80194b00512cca2e24a9
Instruction ID: 50a6c3a39f10df5c366417f20a338d634cb520cfb5e7c8447caf8cb25a6cc2be
Opcode Fuzzy Hash: 6134646c71f7b2b0e13aabe89da7a164b605fd00716a80194b00512cca2e24a9
Instruction Fuzzy Hash: DBC16D30A002099FCB14DF69C884A9EBBFAFF49318F16C559E919EB265D731ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013616C8, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa8f5673bc5844b47104dac5c6940b2f184e59643412278b765f89c609c580f
Instruction ID: 24560c6a09819502d38d80026b4e2de42723169921041fdd4f38fc941bc207d1
Opcode Fuzzy Hash: afa8f5673bc5844b47104dac5c6940b2f184e59643412278b765f89c609c580f
Instruction Fuzzy Hash: 6891CF353042158FDB169F68C894B6E7FFAABC9209F048569E906CB385DF78CC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01361AD0, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb13d74e1224598e9184b0e2d47752d9dee8781bad8c7c409d2baf6297caaa47
Instruction ID: 60d2146403a13bbc73cc8357f085e582d023287260ba4bd32f65f28e121b0cc7
Opcode Fuzzy Hash: fb13d74e1224598e9184b0e2d47752d9dee8781bad8c7c409d2baf6297caaa47
Instruction Fuzzy Hash: C091CC34A002058FDB14DFACC4849AEBBBABFC9249B15C16AD506DB76DDB31EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01364C98, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071f70a08c4ed7eae43f11915c2b79f0d8506aa7f3629b75190aae7be6e13079
Instruction ID: a0cbe83c7026ea053b166b12d2cfb10560da36299a3d275dea0e527c048570b7
Opcode Fuzzy Hash: 071f70a08c4ed7eae43f11915c2b79f0d8506aa7f3629b75190aae7be6e13079
Instruction Fuzzy Hash: F271F230B042148FDB199B78D8946BE7FBEEF89618B14846AE506CB396DF30DC41C791

Uniqueness

Uniqueness Score: -1.00%

Function 01365688, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa78500e360de15ae47214db51d1e7489dc301187c7a04653bbf85ba3af0633e
Instruction ID: 96689e4bfdfbb9c932792b19e2767253a68ad71eaf695eab8af54af21f1aaeaf
Opcode Fuzzy Hash: fa78500e360de15ae47214db51d1e7489dc301187c7a04653bbf85ba3af0633e
Instruction Fuzzy Hash: 7F919D35A00215CFCB11CF68C484AAEBFB9FF55358B1AC4AAE9159B266C734EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0136D4AF, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c905c3eaafaed706d514a4bf149803f3c8f4122a910f7eb1ba163c8a39cbfc
Instruction ID: 4634fa23a08f6475659c77c134e59577b1c03c87049ee8b1b878e086f517e347
Opcode Fuzzy Hash: 99c905c3eaafaed706d514a4bf149803f3c8f4122a910f7eb1ba163c8a39cbfc
Instruction Fuzzy Hash: AC713971B043848FC705DBBC88546BA7FFA9F85219B19C4ABD195CB652DB38CC0AC791

Uniqueness

Uniqueness Score: -1.00%

Function 01363AC8, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e864c4308603ecd685775ae1f67f94bd60b9a3bb2015417eae127f11c80d52a8
Instruction ID: e843e5dbde433861d6499a6f701166ddd30bc53a8bd7f0b7a9317578a0693032
Opcode Fuzzy Hash: e864c4308603ecd685775ae1f67f94bd60b9a3bb2015417eae127f11c80d52a8
Instruction Fuzzy Hash: 0F51AE353181058FDB14DF3EC88496ABBEDFF4575871984AAE51ACB3AADB21DC01C750

Uniqueness

Uniqueness Score: -1.00%

Function 013658F8, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2e629dd24e4369e6e5ccb415f09aab1abac3b1a845b124bc141257204bfba2
Instruction ID: 977931ad2b1e1f47ab125d7db2f4abbaed9aa5f93c439bed344fa1d8e9051c8b
Opcode Fuzzy Hash: 8f2e629dd24e4369e6e5ccb415f09aab1abac3b1a845b124bc141257204bfba2
Instruction Fuzzy Hash: 9641C3713046058FDB169F28D8156AE3FFAEB86265B04807AF94ACB252CB38CC15DB51

Uniqueness

Uniqueness Score: -1.00%

Function 013614A8, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22985d988fcf1c07f750e5f1656e75a3fc34b86efa63285880e8115ea19a6702
Instruction ID: 9ca9d74d41bb385fb0cc52e1dcfbf25336eabf02650a5f821a94b6d5311c5e2f
Opcode Fuzzy Hash: 22985d988fcf1c07f750e5f1656e75a3fc34b86efa63285880e8115ea19a6702
Instruction Fuzzy Hash: 6841B031700249DFCF069F69D854AAE7FBAEB89315F08802AFA06D7255CB35CC15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 01362618, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f637e4de2de6e4d26bc01281cf7afe3844a07e8774fd370b529b5381dfdb0665
Instruction ID: 1380bfb2bbe4e26afaf254f267de51b1f356804786ff87eac79cf0c269c9b799
Opcode Fuzzy Hash: f637e4de2de6e4d26bc01281cf7afe3844a07e8774fd370b529b5381dfdb0665
Instruction Fuzzy Hash: 6241C330604209DFDB119F68C804BBBBBFAEB84318F06C46AE8559B656CBB5DC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013638D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f15b61e380ab5b7fe40184b89b041d8129596ca9d76351817ed0216371c557
Instruction ID: d31850ec7ec9c7465d70b6c37fbfa9d88e14383587c974cb84f0db1dbfb56bd2
Opcode Fuzzy Hash: 11f15b61e380ab5b7fe40184b89b041d8129596ca9d76351817ed0216371c557
Instruction Fuzzy Hash: DC413A756401198FDB148F29C948BAE7BBAFF88318F108069F90A9B3A1CB71DC40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01363D08, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c784c92c6a7b76250522f55edc31425739b519a0972c728f59152f14af68705
Instruction ID: a4acd48746be2d7c1f6c1764eab7410e7f10322099b50de7b64fc179666ee13e
Opcode Fuzzy Hash: 1c784c92c6a7b76250522f55edc31425739b519a0972c728f59152f14af68705
Instruction Fuzzy Hash: 7721F4313042158BDB262639889457E3FAFBF9151C718C07AE50ECBB9ADF29CC119392

Uniqueness

Uniqueness Score: -1.00%

Function 0136AF0F, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7d6f1c26573829af0a9e0409c821f82b06217da7b51538012c1443b4d7ba81
Instruction ID: f982f1805175e22220482ee06ebe7eb10619096e3a3c04f945005b78b1f061a3
Opcode Fuzzy Hash: 8e7d6f1c26573829af0a9e0409c821f82b06217da7b51538012c1443b4d7ba81
Instruction Fuzzy Hash: 8B31A170A042449FCB01CF78D89469DBFF6EF8A318F28C0AAD508EB356E7359946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0136F078, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7360fca70b085826c442f310cdcc53ef4063fbeca7d03764752c4f680f94f4fe
Instruction ID: b2fcf18ee2641407b0ea13553366be74f5af56859198f92f17f91ac5eac0966c
Opcode Fuzzy Hash: 7360fca70b085826c442f310cdcc53ef4063fbeca7d03764752c4f680f94f4fe
Instruction Fuzzy Hash: E331D731B042458FC741DB7CE8549AE7BF9FF8D219B18C4AAD449DB356EA388C06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01363D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfc28da9d7643d744b36f660e16a13239db32abd89d8196d524e23c630c7406
Instruction ID: 6e9c2c350072a9f686fcde7a40250a83500853da3c9f9f01d2bcc021527247e6
Opcode Fuzzy Hash: 5bfc28da9d7643d744b36f660e16a13239db32abd89d8196d524e23c630c7406
Instruction Fuzzy Hash: 4221B3313042154BDB15662988946BE7EAFBFC061DB24C039D50ECB79ADF69CC529391

Uniqueness

Uniqueness Score: -1.00%

Function 01363C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70fa005560b850233d3d656f87629609fe1ad8aa9497270332b4e118c34d32b
Instruction ID: 80caf4b21e443a784630804611369eb59167ea913e6ea332d3af6b4534d5ad30
Opcode Fuzzy Hash: a70fa005560b850233d3d656f87629609fe1ad8aa9497270332b4e118c34d32b
Instruction Fuzzy Hash: 93216B313181598FEB108E6B9840A7B7FEEFB95254B05C42AF95AC724DDA35C801C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01361AC0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c3705199f0e8728adaa98522d618c57485a91a46e4d39284db3d7b35f943b2
Instruction ID: 17c059bd7c25da3ecf5502a990f42c8dbb4e87f31e79b7a3d492236b2efbddd4
Opcode Fuzzy Hash: d9c3705199f0e8728adaa98522d618c57485a91a46e4d39284db3d7b35f943b2
Instruction Fuzzy Hash: 07113A367106018BF7265669D4505BEBFFDEFC42A9B08816AD902DB748CF34CC0687D0

Uniqueness

Uniqueness Score: -1.00%

Function 013DD53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608433346.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52a32630811df8661b79ac00506f2712b95009f16959116863bd7e97c13bb34
Instruction ID: 9985a7ecbe0a622c94cb0a4c8491266d56b76762bc7e67a6c2dc6ca75dd9ec0f
Opcode Fuzzy Hash: d52a32630811df8661b79ac00506f2712b95009f16959116863bd7e97c13bb34
Instruction Fuzzy Hash: 9E213AB2504244DFDF05DF98E9C0F26BF6AFB8432CF248569E8054B286C336D856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 013DD450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608433346.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570dee2a76ba3555846aa6849c80285a3a3ff654e10e21850ad1d8df795f3321
Instruction ID: c11be9b0a952d90b30a602aa751e845b72efd6f533336d72db168ee3c0dd7c0a
Opcode Fuzzy Hash: 570dee2a76ba3555846aa6849c80285a3a3ff654e10e21850ad1d8df795f3321
Instruction Fuzzy Hash: ED213672504244EFDB01DF94E9C0F67BF75FB88328F248568D8051B286C736E855C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 013619F0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9149018cfa7ea0fca4b900fcd18838c32475f0f758c02cf3fe29cde1b019be2
Instruction ID: 176c6ef20c9d1427a91f9de5a04ec65e768e9d65062adc6e464bc8fea7272805
Opcode Fuzzy Hash: d9149018cfa7ea0fca4b900fcd18838c32475f0f758c02cf3fe29cde1b019be2
Instruction Fuzzy Hash: AB21DE353016118BE7299B69D49496FBBFAFFC4659B14C22AE906CB754CF34DC028BC0

Uniqueness

Uniqueness Score: -1.00%

Function 013ED01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608474857.00000000013ED000.00000040.00000001.sdmp, Offset: 013ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d48bab89e52f3b55c90dd099320a786ea6814d6ad5110d4ff78cb7dc7821a2
Instruction ID: 89291b69802e7b34f49c2099d032eecbda9d63b17f4e721677faaa8e78e51dcc
Opcode Fuzzy Hash: a0d48bab89e52f3b55c90dd099320a786ea6814d6ad5110d4ff78cb7dc7821a2
Instruction Fuzzy Hash: C221F571504344DFDB15CF58D9C8B16BFA5FB84358F28C969D8094B786C336DC46CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 01361628, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f0eb4019618a5dcb38e4ac83bde7fc5910fbfdcadd9f611b9ad23f937b065c
Instruction ID: 1517e91f9561256d2d0915203339327d62cfc77b6f6df41b3725adc0c5d3957e
Opcode Fuzzy Hash: a2f0eb4019618a5dcb38e4ac83bde7fc5910fbfdcadd9f611b9ad23f937b065c
Instruction Fuzzy Hash: 30113836B002556FCB069E59A820AAF7FBFEBC8660B0CC01BFA15C7245CE308D219795

Uniqueness

Uniqueness Score: -1.00%

Function 013619E0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19abc151f3397e3511cdab194748a95ebff3587f28c98ca2498fb30d5ab1537
Instruction ID: 6b7c22ab6f96346b8fc3e2d988e84fdabf1d3a758c92cce2062f5d633ccbc12f
Opcode Fuzzy Hash: d19abc151f3397e3511cdab194748a95ebff3587f28c98ca2498fb30d5ab1537
Instruction Fuzzy Hash: 391101313056118FE7199B29D8A487EBFFAAFC565870881BAE902CB765CF20CC0687D0

Uniqueness

Uniqueness Score: -1.00%

Function 01365850, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509906d131e86e3000bafbbc71151c4a86c2eed8529e2a708f3302195d468552
Instruction ID: b0a8d47b64ea57527fdca5d58380b2a94ccf13c57991e798bfab86ec1523bfc4
Opcode Fuzzy Hash: 509906d131e86e3000bafbbc71151c4a86c2eed8529e2a708f3302195d468552
Instruction Fuzzy Hash: AD118B71E0024ADFDB01DFA9D8445AEBFB9BF89210F00846BE411E3201D7748A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0136B488, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2718148dbaf6adeca03dd83a1fd7c2db6543de53a98b1f56673caf2efc7cd4
Instruction ID: 363e28bee9f65461b0e0bc0de0ed138c42e8825e690d8098892d7b81abf87558
Opcode Fuzzy Hash: 6f2718148dbaf6adeca03dd83a1fd7c2db6543de53a98b1f56673caf2efc7cd4
Instruction Fuzzy Hash: EB21D574E102188BCB24DFB4D9586ADBBB5BF48304F10846AE50AEB344EF35A845CF40

Uniqueness

Uniqueness Score: -1.00%

Function 013DD537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608433346.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction ID: 4b7572570c3c39edaad152e8afbbd5249bfa53981c3895f49a480f72cd18ea8a
Opcode Fuzzy Hash: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction Fuzzy Hash: B511D376404280CFDB16CF54E5C4B16BF72FB84328F28C6A9D8494B657C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013DD44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608433346.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction ID: 740799b962028f5b56c88f4d23cf49edff91c7ee0776b02dc109768115641dee
Opcode Fuzzy Hash: 089f040691d95437d3e3945d9fc2aad68fd74f4be42516a5277ab229e787303f
Instruction Fuzzy Hash: 6511B176404280CFDB16CF54E9C4B16BF72FB84328F2886A9D8050B657C336D55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013616B8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa40acf94058e856b0509fb6976cfde503f0a127527d0590e54f532ff650816b
Instruction ID: ff1ad4d4bd438676539e34ffd8a1b48633014c59135c423005a99924281473d6
Opcode Fuzzy Hash: fa40acf94058e856b0509fb6976cfde503f0a127527d0590e54f532ff650816b
Instruction Fuzzy Hash: 521179762042099FD711CF08E880A9ABFF9FF89325B09C166E908DB256C334EC11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013ED017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608474857.00000000013ED000.00000040.00000001.sdmp, Offset: 013ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56df88b9b7a1166935ae8fa4ca7bf63e7314e17cb226e706ca627439ff04c8a
Instruction ID: 564c7d506842b449d97bcc393e27d8dcbe24c298b4521106f274ff21792e0227
Opcode Fuzzy Hash: d56df88b9b7a1166935ae8fa4ca7bf63e7314e17cb226e706ca627439ff04c8a
Instruction Fuzzy Hash: 4511BE75504380CFDB12CF54D5C4B15BFA1FB44318F28C6A9D8094B696C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0136F0D8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0a40a65113971a78936ba9d21b397575a3cfe4519eeebff26964e3423ab90d
Instruction ID: bde8eae479523db6f29f029a5e6da0c1b648907d95b124c743861aa5ae4b076a
Opcode Fuzzy Hash: 9f0a40a65113971a78936ba9d21b397575a3cfe4519eeebff26964e3423ab90d
Instruction Fuzzy Hash: C0112A30F102159FCB40EBBDE8459AEBBFAFB8C2557108429E51AE7344EF389D018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0136DE50, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce014881e50541329bbdc29eb3e3c431eb7792fe62c0482c3a15505920e5354
Instruction ID: 0308cfd2fae62289941455af41dfa07f0138ad442eb4a17280de4e2fe45c3680
Opcode Fuzzy Hash: 8ce014881e50541329bbdc29eb3e3c431eb7792fe62c0482c3a15505920e5354
Instruction Fuzzy Hash: 07F0B4353183808FC3069B7AD8589753FAAAFCA51531E80EAE549CF37ADA61DC018790

Uniqueness

Uniqueness Score: -1.00%

Function 0136AE98, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dda2a86f0c4afa9a45d82b42324cefe2e4ce0af246a2b322f12a02787ba673
Instruction ID: aba7db4be9b90f8bfcdc88bf7880fce7963e88e4e7220602cc9f2bcc62a42e37
Opcode Fuzzy Hash: 24dda2a86f0c4afa9a45d82b42324cefe2e4ce0af246a2b322f12a02787ba673
Instruction Fuzzy Hash: 52F0BB72E041855FC7509B7898491BE7FF89F89225F1440EAE549E7201F6344A01C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0136DE60, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415babcf61ec56bca7e2dad3fc676ef2d1f09c0db0648e54cb82f7bf96b089d4
Instruction ID: c8d63c314603d01b1a55e607b514d66342367ab4b9d083cb542a43aeb7e92c9e
Opcode Fuzzy Hash: 415babcf61ec56bca7e2dad3fc676ef2d1f09c0db0648e54cb82f7bf96b089d4
Instruction Fuzzy Hash: 35F0FE353202148FD708AB6AD85892A3BAEEBC8615715C0AAF50ACB265DEB1DC018790

Uniqueness

Uniqueness Score: -1.00%

Function 0136F138, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776e99d147f46dd2c36a657e725b03a80d4bf827de5247bd1831dcbb39fe3c89
Instruction ID: 54ac7b381743b239eb8de29914612943b002c83c9d2bfc69a106f22d5ef882e1
Opcode Fuzzy Hash: 776e99d147f46dd2c36a657e725b03a80d4bf827de5247bd1831dcbb39fe3c89
Instruction Fuzzy Hash: 8EE03935B101159BCB00EBBCE44489D73F9BF882597118065E90AE7348DE389C018B90

Uniqueness

Uniqueness Score: -1.00%

Function 0136AEA8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8faea39fd6cbbf10c8ccef4f9ef42e14d0fd6c50607082f86f0fa93967536932
Instruction ID: 79c7aa48425b1b9b2b15b5ab7846f2500099afd5ace0fec2e1b673115045cc3d
Opcode Fuzzy Hash: 8faea39fd6cbbf10c8ccef4f9ef42e14d0fd6c50607082f86f0fa93967536932
Instruction Fuzzy Hash: 3AE01272E001199F8B509BAD98055AE7EFDEA8C221B114076E509E3204EA7049018BD1

Uniqueness

Uniqueness Score: -1.00%

Function 01361D70, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df1d98e49727ac02e296f11eacdcd2df62f50b89daf0770a63380509cf6dc29
Instruction ID: 0520d51fd44de9aec294737c58e65caaf473c8ae86ca8c5cc975b4b4250c7e1b
Opcode Fuzzy Hash: 8df1d98e49727ac02e296f11eacdcd2df62f50b89daf0770a63380509cf6dc29
Instruction Fuzzy Hash: 1AE0C27105C78149C302DF64F9525803B35AE82119347CA62E004CA9B2EBB88D24C386

Uniqueness

Uniqueness Score: -1.00%

Function 0136BC34, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f81951ae3cb0c47d6a7690ce43e6e2449e35bffb3bccc1d59a9e0f6f66ba6a
Instruction ID: e18ac1c50b163555d733051d5d36e2edf50ff15e3040e088575537d5e8ad91e4
Opcode Fuzzy Hash: b8f81951ae3cb0c47d6a7690ce43e6e2449e35bffb3bccc1d59a9e0f6f66ba6a
Instruction Fuzzy Hash: 27D012147112169A9F081AFB265127E10CE0AC409EB548C76944BCF1DFFE1CCF841262

Uniqueness

Uniqueness Score: -1.00%

Function 0136D122, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6544172313ec2cd1f000cf5983cd4adafa6a216dde8560ea4231a4d0f538764
Instruction ID: 34cb448899028fab7b53de7d427fd57a70f583894275b64f086ba3594516b6b3
Opcode Fuzzy Hash: d6544172313ec2cd1f000cf5983cd4adafa6a216dde8560ea4231a4d0f538764
Instruction Fuzzy Hash: 26D0C932A202048BCF146BB8F40A0DCBF35FF8422AB1100BAE90696550DF715C699B50

Uniqueness

Uniqueness Score: -1.00%

Function 01361D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec432fdd8dd639f0c69acf2ec7cbec5ce8603ce41c36b3ac1afd486fbd13245
Instruction ID: d7d3d4da9da330a4c9c33e1e5a700a1e0f8b1d3a21b6ffd244a9dde7a6f0660d
Opcode Fuzzy Hash: cec432fdd8dd639f0c69acf2ec7cbec5ce8603ce41c36b3ac1afd486fbd13245
Instruction Fuzzy Hash: F8C0127046871A46C540FF74F4415153B2E9EC1109342CA31E1054A225DFB86D1997C5

Uniqueness

Uniqueness Score: -1.00%

Function 01369629, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.608244890.0000000001360000.00000040.00000001.sdmp, Offset: 01360000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c151d9e5f15a35fd5249ba2a62e2d1daca8632c4318b04160c41ade9c06d687
Instruction ID: dad900aff174b4aca7943d7b5ec981d77b3be547279403ec4526946f863f8b67
Opcode Fuzzy Hash: 4c151d9e5f15a35fd5249ba2a62e2d1daca8632c4318b04160c41ade9c06d687
Instruction Fuzzy Hash: 2FC04C3AB550188BDE149B48F8556DCF739E784229F5041E3D2199384487711A554B90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report CoYUNxCu9sAz7iQ.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre