Play interactive tour

Edit tour

Analysis Report INV01562.exe

Overview

General Information

Sample Name:	INV01562.exe
Analysis ID:	356538
MD5:	513d86dd42100ea5c41bb0ac562cee55
SHA1:	0887972445e88c9628cc46a61b51fa140d5bd675
SHA256:	ad2e708430f74c1382ac3d83421e940414f109dbc76a8b4504f152b6ed237670
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

INV01562.exe (PID: 6992 cmdline: 'C:\Users\user\Desktop\INV01562.exe' MD5: 513D86DD42100EA5C41BB0AC562CEE55)

schtasks.exe (PID: 4524 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

INV01562.exe (PID: 5776 cmdline: {path} MD5: 513D86DD42100EA5C41BB0AC562CEE55)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "=0AZJ26VmdE", "URL: ": "http://ONYvyFrci4NQP.com", "To: ": "", "ByHost: ": "mail.dorreve.com:587", "Password: ": "=0A1pKvEuI", "From: ": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: INV01562.exe PID: 5776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: INV01562.exe PID: 5776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: INV01562.exe PID: 6992	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.INV01562.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.INV01562.exe.434dd98.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.INV01562.exe.4383fb8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.INV01562.exe.434dd98.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.INV01562.exe.42486e8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\INV01562.exe' , ParentImage: C:\Users\user\Desktop\INV01562.exe, ParentProcessId: 6992, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp', ProcessId: 4524

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: INV01562.exe.5776.6.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "=0AZJ26VmdE", "URL: ": "http://ONYvyFrci4NQP.com", "To: ": "", "ByHost: ": "mail.dorreve.com:587", "Password: ": "=0A1pKvEuI", "From: ": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\ChpWNEmipxih.exe

ReversingLabs: Detection: 10%

Multi AV Scanner detection for submitted file

Show sources

Source: INV01562.exe

ReversingLabs: Detection: 10%

Source: 6.2.INV01562.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Show sources

Source: INV01562.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: INV01562.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49755 -> 108.163.193.210:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.6:49756 -> 108.163.193.210:587

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://ONYvyFrci4NQP.com

Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: INV01562.exe, 00000006.00000002.602052637.0000000002CA8000.00000004.00000001.sdmp	String found in binary or memory: http://ONYvyFrci4NQP.com
Source: INV01562.exe	String found in binary or memory: http://code.google.com/feeds/p/topicalmemorysystem/downloads/basic.xml
Source: INV01562.exe	String found in binary or memory: http://code.google.com/p/topicalmemorysystem/
Source: INV01562.exe, 00000006.00000002.602377629.0000000002CE9000.00000004.00000001.sdmp	String found in binary or memory: http://dorreve.com
Source: INV01562.exe, 00000001.00000003.338652353.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://en.w8
Source: INV01562.exe, 00000001.00000003.338485825.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://hDXvRr.com
Source: INV01562.exe, 00000006.00000002.602377629.0000000002CE9000.00000004.00000001.sdmp	String found in binary or memory: http://mail.dorreve.com
Source: INV01562.exe, 00000001.00000002.391105435.00000000031F1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: INV01562.exe	String found in binary or memory: http://topicalmemorysystem.googlecode.com/files/
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: INV01562.exe, 00000001.00000003.342976331.0000000005F63000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.343052853.0000000005F63000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: INV01562.exe	String found in binary or memory: http://www.biblegateway.com/passage/?search=
Source: INV01562.exe	String found in binary or memory: http://www.biblija.net/biblija.cgi?m=
Source: INV01562.exe	String found in binary or memory: http://www.blueletterbible.org/Bible.cfm?b=
Source: INV01562.exe, 00000001.00000003.342107270.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com$
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com-dg
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.
Source: INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCO
Source: INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coma
Source: INV01562.exe, 00000001.00000003.341638917.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comd
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comde
Source: INV01562.exe, 00000001.00000003.341448446.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comeI
Source: INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comes
Source: INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comfac
Source: INV01562.exe, 00000001.00000003.341714081.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comh
Source: INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comint
Source: INV01562.exe, 00000001.00000003.341589885.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comj
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: INV01562.exe, 00000001.00000003.341448446.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comou
Source: INV01562.exe	String found in binary or memory: http://www.esvstudybible.org/search?q=
Source: INV01562.exe	String found in binary or memory: http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp, INV01562.exe, 00000001.00000003.346822822.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.346760612.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: INV01562.exe, 00000001.00000003.350835201.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers(
Source: INV01562.exe, 00000001.00000003.345109661.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: INV01562.exe, 00000001.00000003.346674174.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: INV01562.exe, 00000001.00000003.347987257.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlo
Source: INV01562.exe, 00000001.00000003.346049455.0000000005F7E000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.346065205.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: INV01562.exe, 00000001.00000003.346822822.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers5
Source: INV01562.exe, 00000001.00000003.346065205.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: INV01562.exe, 00000001.00000003.345692898.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.350835201.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersP
Source: INV01562.exe, 00000001.00000003.345109661.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersp
Source: INV01562.exe, 00000001.00000003.345692898.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerst
Source: INV01562.exe, 00000001.00000002.390558833.00000000016A7000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comdiao&
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: INV01562.exe, 00000001.00000003.339834958.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.c
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn.
Source: INV01562.exe, 00000001.00000003.340578674.0000000005F61000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: INV01562.exe, 00000001.00000003.340154969.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnhkP
Source: INV01562.exe, 00000001.00000003.340486777.0000000005F61000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnicrC
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: INV01562.exe, 00000001.00000003.348503106.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: INV01562.exe, 00000001.00000003.348503106.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm.
Source: INV01562.exe, 00000001.00000003.339834958.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.k
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-uW
Source: INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.krm
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: INV01562.exe, 00000001.00000003.344644536.0000000005F5F000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: INV01562.exe, 00000001.00000003.346374783.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.1
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.coma
Source: INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.come
Source: INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comj
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: INV01562.exe, 00000001.00000003.343018648.0000000005F63000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.comT
Source: INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krE
Source: INV01562.exe, 00000001.00000003.339566214.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krn-us
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: INV01562.exe, 00000001.00000003.342012433.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com1
Source: INV01562.exe, 00000001.00000003.340922193.0000000005F61000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com8
Source: INV01562.exe, 00000001.00000003.342039827.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comic
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: INV01562.exe, 00000001.00000003.347245535.0000000005F68000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: INV01562.exe, 00000001.00000003.344961325.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de(
Source: INV01562.exe, 00000001.00000003.347245535.0000000005F68000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de.j
Source: INV01562.exe, 00000001.00000003.344764799.0000000005F5F000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de?
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: INV01562.exe, 00000001.00000003.345378020.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.dey1
Source: INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnP
Source: INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cneI
Source: INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.
Source: INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.b
Source: INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnsk
Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: INV01562.exe, 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp, INV01562.exe, 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: C:\Users\user\Desktop\INV01562.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 6.2.INV01562.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b1F6C6701u002d34B9u002d4345u002d90A4u002dB6F6C9C845F6u007d/C1436BFDu002dFAFDu002d4F86u002d92DAu002dF86FD8442AC9.cs

Large array initialization: .cctor: array initializer size 11950

Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_0167D20C	1_2_0167D20C
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_0167F2C0	1_2_0167F2C0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_0167F2D0	1_2_0167F2D0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_09336010	1_2_09336010
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_093378B1	1_2_093378B1
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_093378C0	1_2_093378C0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_09331D7D	1_2_09331D7D
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_09330006	1_2_09330006
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_09330040	1_2_09330040
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_0933555B	1_2_0933555B
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_093355C6	1_2_093355C6
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D068B0	6_2_00D068B0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D036A8	6_2_00D036A8
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D0F3D8	6_2_00D0F3D8
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D05B50	6_2_00D05B50
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D0D898	6_2_00D0D898
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_027446A0	6_2_027446A0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_027445B0	6_2_027445B0
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_05B37540	6_2_05B37540
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_05B394F8	6_2_05B394F8
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_05B36928	6_2_05B36928
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_05B36C70	6_2_05B36C70

Source: INV01562.exe, 00000001.00000002.399368322.00000000079A0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs INV01562.exe
Source: INV01562.exe, 00000001.00000002.399722957.0000000008DF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs INV01562.exe
Source: INV01562.exe, 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameBpjccrAFYAOOIEcZSbkHoAEMzlFBSaeonAOhcQT.exe4 vs INV01562.exe
Source: INV01562.exe, 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameNT1ms*YMnDC vs INV01562.exe
Source: INV01562.exe, 00000001.00000002.399433412.0000000007A00000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs INV01562.exe
Source: INV01562.exe, 00000001.00000002.399433412.0000000007A00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs INV01562.exe
Source: INV01562.exe, 00000006.00000002.600139709.0000000000D10000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs INV01562.exe
Source: INV01562.exe, 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameBpjccrAFYAOOIEcZSbkHoAEMzlFBSaeonAOhcQT.exe4 vs INV01562.exe
Source: INV01562.exe, 00000006.00000002.600104428.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs INV01562.exe
Source: INV01562.exe, 00000006.00000002.599761413.0000000000BDA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs INV01562.exe
Source: INV01562.exe, 00000006.00000000.388419314.00000000005EC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNT1ms*YMnDC vs INV01562.exe
Source: INV01562.exe, 00000006.00000002.600079703.0000000000CE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs INV01562.exe
Source: INV01562.exe	Binary or memory string: OriginalFilenameNT1ms*YMnDC vs INV01562.exe

Source: INV01562.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6.2.INV01562.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.INV01562.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/3@0/0

Source: C:\Users\user\Desktop\INV01562.exe

File created: C:\Users\user\AppData\Roaming\ChpWNEmipxih.exe

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe	Mutant created: \Sessions\1\BaseNamedObjects\DogqitrWxB
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1604:120:WilError_01

Source: C:\Users\user\Desktop\INV01562.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp

Jump to behavior

Source: INV01562.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INV01562.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\INV01562.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: INV01562.exe

ReversingLabs: Detection: 10%

Source: C:\Users\user\Desktop\INV01562.exe

File read: C:\Users\user\Desktop\INV01562.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\INV01562.exe 'C:\Users\user\Desktop\INV01562.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\INV01562.exe {path}
Source: C:\Users\user\Desktop\INV01562.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process created: C:\Users\user\Desktop\INV01562.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: INV01562.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: INV01562.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Source: C:\Users\user\Desktop\INV01562.exe	Code function: 1_2_09773DC5 push FFFFFF8Bh; iretd	1_2_09773DC7
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_00D0B597 push edi; retn 0000h	6_2_00D0B599
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_0274CD51 push esp; iretd	6_2_0274CD5D
Source: C:\Users\user\Desktop\INV01562.exe	Code function: 6_2_0274DD26 push FFFFFF8Bh; iretd	6_2_0274DD3B

Source: initial sample	Static PE information: section name: .text entropy: 6.80837869151
Source: initial sample	Static PE information: section name: .text entropy: 6.80837869151

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\INV01562.exe

File created: C:\Users\user\AppData\Roaming\ChpWNEmipxih.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp'

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\INV01562.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\INV01562.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\INV01562.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\INV01562.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Window / User API: threadDelayed 9524

Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe TID: 6996	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe TID: 7044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe TID: 6228	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe TID: 348	Thread sleep count: 338 > 30	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe TID: 348	Thread sleep count: 9524 > 30	Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: INV01562.exe, 00000006.00000002.599830619.0000000000C04000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\INV01562.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\Desktop\INV01562.exe

Code function: 6_2_00D00A70 KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,KiUserExceptionDispatcher,

6_2_00D00A70

Source: C:\Users\user\Desktop\INV01562.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\INV01562.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Process created: C:\Users\user\Desktop\INV01562.exe {path}			Jump to behavior

Source: INV01562.exe, 00000006.00000002.600313195.0000000001320000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: INV01562.exe, 00000006.00000002.600313195.0000000001320000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: INV01562.exe, 00000006.00000002.600313195.0000000001320000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: INV01562.exe, 00000006.00000002.600313195.0000000001320000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Users\user\Desktop\INV01562.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Users\user\Desktop\INV01562.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\INV01562.exe

Code function: 6_2_05B35A94 GetUserNameW,

6_2_05B35A94

Source: C:\Users\user\Desktop\INV01562.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV01562.exe PID: 5776, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV01562.exe PID: 6992, type: MEMORY
Source: Yara match	File source: 6.2.INV01562.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.434dd98.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.4383fb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.434dd98.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.42486e8.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\INV01562.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\INV01562.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\INV01562.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\INV01562.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\INV01562.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV01562.exe PID: 5776, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV01562.exe PID: 5776, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV01562.exe PID: 6992, type: MEMORY
Source: Yara match	File source: 6.2.INV01562.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.434dd98.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.4383fb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.434dd98.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.INV01562.exe.42486e8.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection12	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery114	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing2	NTDS	Query Registry1	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Security Software Discovery221	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion14	Cached Domain Credentials	Virtualization/Sandbox Evasion14	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
INV01562.exe	11%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ChpWNEmipxih.exe	11%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.INV01562.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.urwpp.de.j	0%	Avira URL Cloud	safe
http://www.tiro.com8	0%	Avira URL Cloud	safe
http://www.carterandcone.comes	0%	URL Reputation	safe
http://www.carterandcone.comes	0%	URL Reputation	safe
http://www.carterandcone.comes	0%	URL Reputation	safe
http://www.carterandcone.comes	0%	URL Reputation	safe
http://www.tiro.com1	0%	Avira URL Cloud	safe
http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.urwpp.dey1	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.urwpp.de(	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.goodfont.co.krm	0%	Avira URL Cloud	safe
http://www.sandoll.co.krE	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.sakkal.comT	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cno.b	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.zhongyicts.com.cnsk	0%	Avira URL Cloud	safe
http://www.esvstudybible.org/search?q=	0%	Avira URL Cloud	safe
http://hDXvRr.com	0%	Avira URL Cloud	safe
http://www.carterandcone.comj	0%	Avira URL Cloud	safe
http://www.carterandcone.comh	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnhkP	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn.	0%	Avira URL Cloud	safe
http://www.carterandcone.com-dg	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnicrC	0%	Avira URL Cloud	safe
http://www.monotype.1	0%	Avira URL Cloud	safe
http://www.carterandcone.comou	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnP	0%	Avira URL Cloud	safe
http://en.w8	0%	Avira URL Cloud	safe
http://www.tiro.comic	0%	URL Reputation	safe
http://www.tiro.comic	0%	URL Reputation	safe
http://www.tiro.comic	0%	URL Reputation	safe
http://www.carterandcone.com$	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comTCO	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm.	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://topicalmemorysystem.googlecode.com/files/	0%	Avira URL Cloud	safe
http://www.carterandcone.com.	0%	URL Reputation	safe
http://www.carterandcone.com.	0%	URL Reputation	safe
http://www.carterandcone.com.	0%	URL Reputation	safe
http://www.zhongyicts.com.cneI	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ONYvyFrci4NQP.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.de.j	INV01562.exe, 00000001.00000003.347245535.0000000005F68000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com8	INV01562.exe, 00000001.00000003.340922193.0000000005F61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comes	INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com1	INV01562.exe, 00000001.00000003.342012433.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.esvstudybible.org/search?q=Whttp://www.blueletterbible.org/Bible.cfm?b=	INV01562.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp, INV01562.exe, 00000001.00000003.346822822.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.346760612.0000000005F5B000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.dey1	INV01562.exe, 00000001.00000003.345378020.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de(	INV01562.exe, 00000001.00000003.344961325.0000000005F5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.ascendercorp.com/typedesigners.html	INV01562.exe, 00000001.00000003.342976331.0000000005F63000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.343052853.0000000005F63000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.goodfont.co.krm	INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.krE	INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	INV01562.exe, 00000001.00000002.391105435.00000000031F1000.00000004.00000001.sdmp	false		high
http://www.carterandcone.como.	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.org%	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	INV01562.exe, 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp, INV01562.exe, 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coma	INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.come	INV01562.exe, 00000001.00000003.341448446.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comd	INV01562.exe, 00000001.00000003.341638917.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.comT	INV01562.exe, 00000001.00000003.343018648.0000000005F63000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cno.b	INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cnsk	INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.biblegateway.com/passage/?search=	INV01562.exe	false		high
http://www.esvstudybible.org/search?q=	INV01562.exe	false	Avira URL Cloud: safe	unknown
http://hDXvRr.com	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comj	INV01562.exe, 00000001.00000003.341589885.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comh	INV01562.exe, 00000001.00000003.341714081.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnhkP	INV01562.exe, 00000001.00000003.340154969.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	INV01562.exe, 00000001.00000003.340578674.0000000005F61000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn.	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com-dg	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	INV01562.exe, 00000001.00000003.346049455.0000000005F7E000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.346065205.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cnicrC	INV01562.exe, 00000001.00000003.340486777.0000000005F61000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.1	INV01562.exe, 00000001.00000003.346374783.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.comou	INV01562.exe, 00000001.00000003.341448446.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnP	INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://en.w8	INV01562.exe, 00000001.00000003.338652353.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.comic	INV01562.exe, 00000001.00000003.342039827.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.carterandcone.com$	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn/bThe	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comTCO	INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm.	INV01562.exe, 00000001.00000003.348503106.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	INV01562.exe, 00000001.00000003.342107270.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://topicalmemorysystem.googlecode.com/files/	INV01562.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersP	INV01562.exe, 00000001.00000003.345692898.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000003.350835201.0000000005F5B000.00000004.00000001.sdmp	false		high
http://www.carterandcone.com.	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cneI	INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	INV01562.exe, 00000001.00000003.348503106.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	INV01562.exe, 00000001.00000003.338485825.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://dorreve.com	INV01562.exe, 00000006.00000002.602377629.0000000002CE9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr-uW	INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.blueletterbible.org/Bible.cfm?b=	INV01562.exe	false		high
http://www.goodfont.co.k	INV01562.exe, 00000001.00000003.339834958.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%GETMozilla/5.0	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	INV01562.exe, 00000001.00000003.339764280.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.coma	INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de	INV01562.exe, 00000001.00000003.347245535.0000000005F68000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comdiao&	INV01562.exe, 00000001.00000002.390558833.00000000016A7000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersp	INV01562.exe, 00000001.00000003.345109661.0000000005F5E000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.come	INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comj	INV01562.exe, 00000001.00000003.336452994.0000000005F42000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designerst	INV01562.exe, 00000001.00000003.345692898.0000000005F5B000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	INV01562.exe, 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlo	INV01562.exe, 00000001.00000003.347987257.0000000005F7E000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comfac	INV01562.exe, 00000001.00000003.341947277.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.c	INV01562.exe, 00000001.00000003.339834958.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://mail.dorreve.com	INV01562.exe, 00000006.00000002.602377629.0000000002CE9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comeI	INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comde	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.biblija.net/biblija.cgi?m=	INV01562.exe	false		high
http://www.urwpp.de?	INV01562.exe, 00000001.00000003.344764799.0000000005F5F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers(	INV01562.exe, 00000001.00000003.350835201.0000000005F5B000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.krn-us	INV01562.exe, 00000001.00000003.339566214.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comint	INV01562.exe, 00000001.00000003.341398991.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	INV01562.exe, 00000001.00000003.341667795.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	INV01562.exe, 00000001.00000003.346674174.0000000005F7E000.00000004.00000001.sdmp	false		high
http://www.monotype.	INV01562.exe, 00000001.00000003.344644536.0000000005F5F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cno.	INV01562.exe, 00000001.00000003.341269412.0000000005F5E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	INV01562.exe, 00000001.00000003.346065205.0000000005F5B000.00000004.00000001.sdmp, INV01562.exe, 00000001.00000002.398391366.0000000006030000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/	INV01562.exe, 00000001.00000003.345109661.0000000005F5E000.00000004.00000001.sdmp	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356538
Start date:	23.02.2021
Start time:	09:47:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INV01562.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/3@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 96% Number of executed functions: 80 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:48:20	API Interceptor	632x Sleep call for process: INV01562.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV01562.exe.log Download File
Process:	C:\Users\user\Desktop\INV01562.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp Download File
Process:	C:\Users\user\Desktop\INV01562.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.160424132139349
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7h2ulNMFp2O/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKB3Rtn:cbha7JlNQV/rydbz9I3YODOLNdq3N
MD5:	A99F8F8D4B10F710A7C50BF776DAEBB3
SHA1:	3EC454B3205EEF3BFF04AEF31F08ADECA6EC23A5
SHA-256:	077F2EDF4808AD47190EA56CB48C3ECE2690D8CC638E323E97524E19F67C7507
SHA-512:	5E3DFBD7761CE6E0395ECE51E0C7853AC2FECF6B834943F19D1D5CDCB665468F6AF1CBD9DD14DB69E961CCCE5417468A08CE1A22CD778356DB27D5A73E1C714C
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvail

C:\Users\user\AppData\Roaming\ChpWNEmipxih.exe Download File
Process:	C:\Users\user\Desktop\INV01562.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	692224
Entropy (8bit):	6.7992899453917515
Encrypted:	false
SSDEEP:	6144:pxwz1c/OmJxTcAWf9apVgF6rOUsnrhlGqCtttttwgGTyWI+xHvqvvq1FgDYEpF2t:0ZTE2vSvcspOxl7CSUJFxisZ
MD5:	513D86DD42100EA5C41BB0AC562CEE55
SHA1:	0887972445E88C9628CC46A61B51FA140D5BD675
SHA-256:	AD2E708430F74C1382AC3D83421E940414F109DBC76A8B4504F152B6ED237670
SHA-512:	36E8E81C7478CEE9E5860E29711C02D7002D5F77F267EFB3EA134C505E63ACCDDE1D7D069639FB1A0BA1E7300A2644D3FD07C028FA9ADAFE09E55A8761263C95
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K4`..............0.............^.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......,[..x............C..ha.............................................}.....(.......(......{....r...p~/...(....o......{....o....&..0............r...p(....&......o....&......................n..t.....o......{....o....&.....(.....~..{....o......{....o....(......0..+.........,..{.......+....,...{....o........( ......0............s!...}.........("...s#.....s$...}.....s%...}.....s%...}......{....s&...}.....s'...}.....s%...}.....s%...}.....s(...}.....{....o).....{....o)..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.7992899453917515
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	INV01562.exe
File size:	692224
MD5:	513d86dd42100ea5c41bb0ac562cee55
SHA1:	0887972445e88c9628cc46a61b51fa140d5bd675
SHA256:	ad2e708430f74c1382ac3d83421e940414f109dbc76a8b4504f152b6ed237670
SHA512:	36e8e81c7478cee9e5860e29711c02d7002d5f77f267efb3ea134c505e63accdde1d7d069639fb1a0ba1e7300a2644d3fd07c028fa9adafe09e55a8761263c95
SSDEEP:	6144:pxwz1c/OmJxTcAWf9apVgF6rOUsnrhlGqCtttttwgGTyWI+xHvqvvq1FgDYEpF2t:0ZTE2vSvcspOxl7CSUJFxisZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K4`..............0.............^.... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4aa55e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60344B99 [Tue Feb 23 00:26:01 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaa50c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa8564	0xa8600	False	0.630830375371	data	6.80837869151	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x5bc	0x600	False	0.426432291667	data	4.14245864032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xac090	0x32c	data
RT_MANIFEST	0xac3cc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016
Assembly Version	1.0.0.0
InternalName	NT1msMnD.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Core.Numero
ProductVersion	1.0.0.0
FileDescription	Core.Numero
OriginalFilename	NT1msMnD.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: INV01562.exe PID: 6992 Parent PID: 5956

General

Start time:	09:48:09
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\INV01562.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\INV01562.exe'
Imagebase:	0xc30000
File size:	692224 bytes
MD5 hash:	513D86DD42100EA5C41BB0AC562CEE55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.394452914.00000000041F9000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 4524 Parent PID: 6992

General

Start time:	09:48:34
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ChpWNEmipxih' /XML 'C:\Users\user\AppData\Local\Temp\tmp8EA8.tmp'
Imagebase:	0x11d0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1604 Parent PID: 4524

General

Start time:	09:48:35
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: INV01562.exe PID: 5776 Parent PID: 6992

General

Start time:	09:48:35
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\INV01562.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x540000
File size:	692224 bytes
MD5 hash:	513D86DD42100EA5C41BB0AC562CEE55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.598365443.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.600806948.0000000002981000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: INV01562.exe PID: 6992 Parent PID: 5956 INV01562.exeCOMMON

Executed Functions

Function 09336010, Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

{, xrefs: 09336779
v, xrefs: 09336772

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: v${
API String ID: 0-2567079138
Opcode ID: 3d7f14cc950359d303b8d05a9371be66fc0f5427e530be99968c6f7ac2ecca55
Instruction ID: 53c4bf77da03ed6b99c311653f079dc00fb1d051afb00e1f09a257faf75426c6
Opcode Fuzzy Hash: 3d7f14cc950359d303b8d05a9371be66fc0f5427e530be99968c6f7ac2ecca55
Instruction Fuzzy Hash: C5416D70D046089FDB08DFA7D84169EBBF7AFC5304F14C5A9D408AB265EB345A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0167C7D8, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0167C848
GetCurrentThread.KERNEL32 ref: 0167C885
GetCurrentProcess.KERNEL32 ref: 0167C8C2
GetCurrentThreadId.KERNEL32 ref: 0167C91B

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6523a8ab2309934af9b8a522832f7d96b27fac74c0f7bfccb7304d744f70c10d
Instruction ID: a6317b5ebcf14e8afd7f4792561518e55afa38461afe8ad9e6258dafbfde7479
Opcode Fuzzy Hash: 6523a8ab2309934af9b8a522832f7d96b27fac74c0f7bfccb7304d744f70c10d
Instruction Fuzzy Hash: 235134B09006498FDB14DFA9D988BDEBFF0AF89314F25855AE409B7350C7345988CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0167C7E8, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0167C848
GetCurrentThread.KERNEL32 ref: 0167C885
GetCurrentProcess.KERNEL32 ref: 0167C8C2
GetCurrentThreadId.KERNEL32 ref: 0167C91B

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 37de4d7e79abfc1ae4b86da55dc33ad7d80f2b6d51418ee11efd3ecb53fe4f26
Instruction ID: 73c0b8cd943ec583cc3cbe65bb075428f77eb57b3300f2adacf37dd8a1486fe5
Opcode Fuzzy Hash: 37de4d7e79abfc1ae4b86da55dc33ad7d80f2b6d51418ee11efd3ecb53fe4f26
Instruction Fuzzy Hash: 8B5154B09006498FEB14DFAAC948B9EBFF4AF89314F24845AE409B7350C7349888CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0167A4F0, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0167A736

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 91648441ba1c6900d031b9aec29df3d364940e7cff79f79075c00a312f000f84
Instruction ID: e974428d08b9be6781f7215a5289981117aea8c9fd8f121735c93094780dd45a
Opcode Fuzzy Hash: 91648441ba1c6900d031b9aec29df3d364940e7cff79f79075c00a312f000f84
Instruction Fuzzy Hash: DA711570A00B058FEB24DF6AD54476ABBF1BF88214F048A2DD58AD7B50EB35E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01675365, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01675421

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 825938b853749e68bee7bb6554a7953c5792aad758b13f50fde3ac870bc29acb
Instruction ID: 232d6a9bad8010a4fd4a7fca8d3eb8113a90ffcc6bb601e006972a992e674a11
Opcode Fuzzy Hash: 825938b853749e68bee7bb6554a7953c5792aad758b13f50fde3ac870bc29acb
Instruction Fuzzy Hash: 07410571D00218CFDB24DFA9C8447CDBBB1BF89304F21806AD409AB255DB755946CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01673E8C, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01675421

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8c02b3c9bf24e23ff4ba02b1396b7e17f0abc0a4947fef1a0333a41f95d373c5
Instruction ID: 5d4c0289c8e0a85275b2e40e510ffb303b0b8a708e52d09d0cbdd211cfc7bfb8
Opcode Fuzzy Hash: 8c02b3c9bf24e23ff4ba02b1396b7e17f0abc0a4947fef1a0333a41f95d373c5
Instruction Fuzzy Hash: 1841F370D0461CCFDB24DFA9C84478EBBB1BF49314F21809AD409BB255DB756946CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0167CA08, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0167CA97

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 231960483fc246657a848cb86d16cc55301d13fb96fb06fad1204dca6289897b
Instruction ID: eb2fa2c0d7d9f97433f446d69db968f299b68169e82275e949a38fb0cc1d9738
Opcode Fuzzy Hash: 231960483fc246657a848cb86d16cc55301d13fb96fb06fad1204dca6289897b
Instruction Fuzzy Hash: 8321E5B59002599FDB10DFAAD884ADEBBF8EB48320F14851AE914A7310D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0167CA10, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0167CA97

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cd80082951c29129e55f9881cdcd59dd5fe7ba9aa384d142518ba0ab66f715df
Instruction ID: 3ce0fd4843e7f4de1f38d0867bd679a355ffeb8916d30a2e627ff2217dda172e
Opcode Fuzzy Hash: cd80082951c29129e55f9881cdcd59dd5fe7ba9aa384d142518ba0ab66f715df
Instruction Fuzzy Hash: 9A21C2B5D00249AFDB10DFAAD984ADEBBF8EB48324F14841AE954A3310D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01679A50, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0167A7B1,00000800,00000000,00000000), ref: 0167A9C2

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dc63a12f75946eb1082bde954ef19547afc977135bce43d23ad68230814141da
Instruction ID: 121012910de0b5e23ec3c5326956e35b053f4e5703dd4f18f9cb9ebe05c48584
Opcode Fuzzy Hash: dc63a12f75946eb1082bde954ef19547afc977135bce43d23ad68230814141da
Instruction Fuzzy Hash: 531114B6D002498FDB10CFAAC844ADEFBF4EB88320F15842AE555B7300C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0167A950, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0167A7B1,00000800,00000000,00000000), ref: 0167A9C2

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4d7a4e5877e4098e989819c7a53185a728c43d0671fe4b9e5a993ba189e45d90
Instruction ID: 988c3a7be29a1b5cfa5f272d817ec901fa49a74b3983a35c7c3f1472505b6abc
Opcode Fuzzy Hash: 4d7a4e5877e4098e989819c7a53185a728c43d0671fe4b9e5a993ba189e45d90
Instruction Fuzzy Hash: E21114B6D002489FDB10CFAAC884BDEFBF4EB88324F15852EE955A7200C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 097717C8, Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0977182D

Memory Dump Source

Source File: 00000001.00000002.400286068.0000000009770000.00000040.00000001.sdmp, Offset: 09770000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 74a31c1f61d06561e99046b5c58d63b67b2dfc71f2a621a513894336cb84fa57
Instruction ID: b96c9f6e5060c0981a8d20eb5506bf616634cc54ec62ca54f6712333beb84643
Opcode Fuzzy Hash: 74a31c1f61d06561e99046b5c58d63b67b2dfc71f2a621a513894336cb84fa57
Instruction Fuzzy Hash: FA1103B58003489FDB10DF99D885BEEFBF8EB48324F14841AE814A3600D375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0167A6D0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0167A736

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 65dd308d67e754d1e322ae4c66aed81c9ea00449a87fbaa0af41469716578af2
Instruction ID: 64fc928098eecbdc307669cc17e13c0bb3af6c557e6213e2ecfd666c2ef75fc4
Opcode Fuzzy Hash: 65dd308d67e754d1e322ae4c66aed81c9ea00449a87fbaa0af41469716578af2
Instruction Fuzzy Hash: 921110B9C002498FDB10CFAAC844BDEFBF8AF88224F15841AD819B7300C374A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 097717D0, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0977182D

Memory Dump Source

Source File: 00000001.00000002.400286068.0000000009770000.00000040.00000001.sdmp, Offset: 09770000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 35f23001f1eaca37b7a2971f67b629c32d6e0dc027bf757800132eb17bd75cad
Instruction ID: e2b83e11d343db40a692a5ad385bd3a44f1a88f8831574f3af8b131d5f14cb54
Opcode Fuzzy Hash: 35f23001f1eaca37b7a2971f67b629c32d6e0dc027bf757800132eb17bd75cad
Instruction Fuzzy Hash: F011E2B58003499FDB10DF9AD884BDEFBF8FB48324F14845AE955A7200D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09336FC8, Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

x:, xrefs: 093370F5

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: x:
API String ID: 0-855141850
Opcode ID: dd82105ac32dc245f43d7492cc1d83d2c34e9f0c177a6d577df681c7f5c819b1
Instruction ID: 7b62ae713d8fd07c60f13c91167ec9c74b945a29488a103a27d0713bdfc380da
Opcode Fuzzy Hash: dd82105ac32dc245f43d7492cc1d83d2c34e9f0c177a6d577df681c7f5c819b1
Instruction Fuzzy Hash: E54179B9A45109AFCF00DFA8D581AEEBBF5EF89344F109169E409AB761D7309D05CF60

Uniqueness

Uniqueness Score: -1.00%

Function 09338E96, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

<, xrefs: 09338F48

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: f3865e58fb64b93d3f4ceabb207a71259af6cf46aad97b578adcbdff227691c5
Instruction ID: 635053fe68f8bd5391dd47f784afb50df6e06de3df3f727290684454b9596a96
Opcode Fuzzy Hash: f3865e58fb64b93d3f4ceabb207a71259af6cf46aad97b578adcbdff227691c5
Instruction Fuzzy Hash: 8E218C75A99118CBCB10DFA8D8417ECB6B9EB4E394F8091E5E50DA7641C7308E908F50

Uniqueness

Uniqueness Score: -1.00%

Function 09336C2B, Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

t, xrefs: 09336C9C

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 8e47b394cb922d94c8a71869fc1ffb7abde81d1af7bd11b7a4f2ba0115781822
Instruction ID: 57fcb2c6b93d8ca8dc18a25fbae2a89b8b2cf8fb883baedcf3bf66a441b2fc84
Opcode Fuzzy Hash: 8e47b394cb922d94c8a71869fc1ffb7abde81d1af7bd11b7a4f2ba0115781822
Instruction Fuzzy Hash: 65F0177484411CCFCB54DF21D8462D8BBB1FB4A344F008599C60AA3392CB345E92CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09336AEF, Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

p, xrefs: 09336B48

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: c70fdd31b1a97c786f8d391922486a211850b7ff08c92b7fe38446f9287ed4a9
Instruction ID: 702634d1ba72976525d8f8bfe7d7ae9dcde72ae6bc6f15b73de8115980a86200
Opcode Fuzzy Hash: c70fdd31b1a97c786f8d391922486a211850b7ff08c92b7fe38446f9287ed4a9
Instruction Fuzzy Hash: 58F03230958128CFEB10DF21D8927ECBBF4EB4A300F008699E91AA23C0C7346E91CF00

Uniqueness

Uniqueness Score: -1.00%

Function 09339FD0, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70b92a28deca3dccfc42423ba8022dd2ae08402b4cfcc6769a7c0233faa221
Instruction ID: 0db86e3cd70a3ff53804fb11f1f1a253baf0745fad098e50318f769bf67a1d57
Opcode Fuzzy Hash: ee70b92a28deca3dccfc42423ba8022dd2ae08402b4cfcc6769a7c0233faa221
Instruction Fuzzy Hash: 4E118631B40214ABCB28DB7989116BF76A6EF84354F44C529E95EC7780DF75CC418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 09336F40, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96de88921aadfcd00fc4d13bbe38038acfe9e99b1bc8dae5af318c7eb7480af
Instruction ID: 2190f7ba8a07512db0c88ec4d4fff1f9597082c7726efeb007b4132c21eedc81
Opcode Fuzzy Hash: a96de88921aadfcd00fc4d13bbe38038acfe9e99b1bc8dae5af318c7eb7480af
Instruction Fuzzy Hash: 4B01DF30A89288AFDB04EFB8D455AAE7FB1EF46209F00099CC500AB250D6700E18CB95

Uniqueness

Uniqueness Score: -1.00%

Function 09336F50, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0990afec70815fa22b963b830f5c6e74caa0988911b0dc049c17d2b5070172b
Instruction ID: d7c91d53ee0b38b5a7461ea7e12a61ffd54c0b15641147d0356e4dae51e84b11
Opcode Fuzzy Hash: e0990afec70815fa22b963b830f5c6e74caa0988911b0dc049c17d2b5070172b
Instruction Fuzzy Hash: 05F0CD30A80208FFDB08FFB8D445AAEB7B0EB46209F5049A8D504A7290EB705E14CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09335D28, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef908d4f539441f85ab1df7560cc570d8804874da923fb0a900e9e185904865
Instruction ID: 3e71c5069c0b4478fbed54231f31a1bf01e52747a8ad6d5d169b60b1882b9284
Opcode Fuzzy Hash: fef908d4f539441f85ab1df7560cc570d8804874da923fb0a900e9e185904865
Instruction Fuzzy Hash: 43F05E34D59248AFCB01DFA8D44499DBFF4EF0A215F2081EAD808E7362D3344945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 09336EE8, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db097a3882bbdb876bf5b4e90df467e7f5c81ae56e884fb1771e88e10d201d1
Instruction ID: 3f8688a4f68fd280a14354f6fcce5dafaf8b30115ad0c1a85758b5dda436ad2a
Opcode Fuzzy Hash: 7db097a3882bbdb876bf5b4e90df467e7f5c81ae56e884fb1771e88e10d201d1
Instruction Fuzzy Hash: BAF03474D04208EFCB04EFA8D4012AEBBF4FB48304F1085AAD814A3345D7754A11DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0933E660, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803190df5a862655b35ebdd7cff38aa28c6c8d4eea6f6e7e5c3593410fc259c9
Instruction ID: 8ca2e0abb1c85d92a9b0a85546b8c2a92c653e22dc17214fea9bc9a6c2f95e50
Opcode Fuzzy Hash: 803190df5a862655b35ebdd7cff38aa28c6c8d4eea6f6e7e5c3593410fc259c9
Instruction Fuzzy Hash: 0AE0ED74D45208EFCB10DFB5E409AAEFBB8EB46341F1091A9DC15A3381E7745A51CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09335D38, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11debcfae2c99f3951ed6e3207815c856ad079f793829accadde52fe2b0494e7
Instruction ID: d8703afa6dce3f794d179f60e658470ba16b33c25f1b6dcfb7c3e102ad216aec
Opcode Fuzzy Hash: 11debcfae2c99f3951ed6e3207815c856ad079f793829accadde52fe2b0494e7
Instruction Fuzzy Hash: 3DE0C234E55208EFCB40DFA9D448A9DBBF8EB49305F20C4A9E808A3321D7309A00CF40

Uniqueness

Uniqueness Score: -1.00%

Function 09335041, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a8f983285771ac8289f9b161e3ae2ac4d84ede6e877f541444a685fcc5709a
Instruction ID: e7d143544e8a0c972521221d31128e1836bdf8d93ab27964eee31967c8257f1e
Opcode Fuzzy Hash: f8a8f983285771ac8289f9b161e3ae2ac4d84ede6e877f541444a685fcc5709a
Instruction Fuzzy Hash: 66D0C9B8D81128CBCB20CF20D8C8699F771AB58340F5092D59409B3201C7301F80CF04

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0933555B, Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

537, xrefs: 093355A0
>23, xrefs: 09335644

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: >23$537
API String ID: 0-3675907610
Opcode ID: 73aa7956215a3e27109b97965740c96b735dae1894f84e65c09a3f8dcb4680a2
Instruction ID: 250e18f18412dbc49942982d17261bebd1540c932fb8b1a68ba56fea1c24cdfc
Opcode Fuzzy Hash: 73aa7956215a3e27109b97965740c96b735dae1894f84e65c09a3f8dcb4680a2
Instruction Fuzzy Hash: 0D31C2369482619FDB1DCF34C4A6AA6BBB1FF4731832595DEC4838F4A6CB326442DB41

Uniqueness

Uniqueness Score: -1.00%

Function 09331D7D, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

9, xrefs: 093320A9

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 6ba37a0c773d7e2479c17a43518b5cdc5c5822e5e6a3483615293099a81f044a
Instruction ID: 1e42d24af15850d2ab8097b46462e4ab761f9cecae69c3f54b59a484e969e5cf
Opcode Fuzzy Hash: 6ba37a0c773d7e2479c17a43518b5cdc5c5822e5e6a3483615293099a81f044a
Instruction Fuzzy Hash: 3291AFB0E0462D8BDB64DF29CE41B8ABBF5FF89300F4181E5D24CA6645E7319E918F06

Uniqueness

Uniqueness Score: -1.00%

Function 093355C6, Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

>23, xrefs: 09335644

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID: >23
API String ID: 0-538537323
Opcode ID: e22fe6fde16edbc49381fb732c594d3ccd6237f5824a9c40af9333ab58dfa4e7
Instruction ID: 90e0bfa9655e48b0870001d9d0a7adc9bbe7f53a4525f7e432931d808f422dab
Opcode Fuzzy Hash: e22fe6fde16edbc49381fb732c594d3ccd6237f5824a9c40af9333ab58dfa4e7
Instruction Fuzzy Hash: 57210035848260DFCB1DCF30C0E2AA6BBB0FF47748324909ED4838A4A6CB722402DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0167F2D0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b671c7b8787fe4491ece304c6e3085ddc5812608435b421de05310e1d2945ac
Instruction ID: 5a5eaf11eefde35f313020c77bad2d38637cd2b1d2a2c31a269b134d28f999bb
Opcode Fuzzy Hash: 3b671c7b8787fe4491ece304c6e3085ddc5812608435b421de05310e1d2945ac
Instruction Fuzzy Hash: C512DAF14117468BE732CF65EC981893B69B745328F90620ADA631BADCD7BC116ACF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0167D20C, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c34e87af8ba272432a2196ec7d2ce3cc8426dd8fcbb388128952ffe160c9d36
Instruction ID: a1413746cb2b021b4eb2f5dddb1b7826d362a17fb0059ecb5a078e7e30f8db9f
Opcode Fuzzy Hash: 6c34e87af8ba272432a2196ec7d2ce3cc8426dd8fcbb388128952ffe160c9d36
Instruction Fuzzy Hash: 42A16F32E0021A8FCF05DFB5C9445DDBBB2FF85300B1585AAE905BB261EB31E959CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0167F2C0, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.390478029.0000000001670000.00000040.00000001.sdmp, Offset: 01670000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b870bdb3310c597e55a9d2506ff45979a04a71819aa767fa98c86778e69ddb
Instruction ID: 63f0eced51d68fdf4ece88b7e9443bd0867575b75e5dcce20c7ef530275d7974
Opcode Fuzzy Hash: 32b870bdb3310c597e55a9d2506ff45979a04a71819aa767fa98c86778e69ddb
Instruction Fuzzy Hash: 04C14FB18117458BE732CF65EC981893BB9FB85328F50630AD5636B6D8D7BC106ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 09330006, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c19d0a4a09e88682af615c28dd8cc4607ef28c6c0f19b942db03c9cf0c0cf75
Instruction ID: 123fba730137f633858078a0d7b3d493db5098cc68b703906280879eb2e5ee9c
Opcode Fuzzy Hash: 3c19d0a4a09e88682af615c28dd8cc4607ef28c6c0f19b942db03c9cf0c0cf75
Instruction Fuzzy Hash: 9751BAB1D056588FEB5DCF678D4069ABBF7AFC9200F18C0FAC548AB265DA3009868F55

Uniqueness

Uniqueness Score: -1.00%

Function 093378C0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b178215515bf040bb3c2f977ff8e3f2c1321f1c433b77e542ba08f6a93b36b1c
Instruction ID: 5e45b3166e97354c873db55c8fd2db7b71527a4edea34ab1824ca0cbd8d961ea
Opcode Fuzzy Hash: b178215515bf040bb3c2f977ff8e3f2c1321f1c433b77e542ba08f6a93b36b1c
Instruction Fuzzy Hash: C94194B2EA410AEFD754CE69C44016EB7B5AB48340F94CA65A05BDB780F678DB418F01

Uniqueness

Uniqueness Score: -1.00%

Function 093378B1, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d362425de6baf9580d16d0834206a730551711c184ac6876dafa62b999a547a
Instruction ID: 817881302336a43d75373a945b345ab6eee6980ba1167782f40fd15bbe958c53
Opcode Fuzzy Hash: 7d362425de6baf9580d16d0834206a730551711c184ac6876dafa62b999a547a
Instruction Fuzzy Hash: 0B41A3B2EA410AEFDB50CE69844015EB7B6AB88340F94CAA5D05BDB780E678DB418F01

Uniqueness

Uniqueness Score: -1.00%

Function 09330040, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.400061331.0000000009330000.00000040.00000001.sdmp, Offset: 09330000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b491b66686550659835c7a600c8e9335da2c39a66d19b816829e173fe2c8cf
Instruction ID: 01b29f94d0716d5b53e108c97bdbf854b160802ab12fd21736ad40fb37159642
Opcode Fuzzy Hash: a1b491b66686550659835c7a600c8e9335da2c39a66d19b816829e173fe2c8cf
Instruction Fuzzy Hash: EF415DB1E016188BEB5CCF6B8D4068AFAF7AFC9300F14C1BAD55CAB215DB3049868F55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: INV01562.exe PID: 5776 Parent PID: 6992 INV01562.exeCOMMON

Executed Functions

Function 00D00A70, Relevance: 7.0, APIs: 4, Instructions: 984libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 073c9be414ffde32cdc7b6b7b6990915952fa3f290ac3694838aba6ee941b747
Instruction ID: 2e76cc0b4650c25abc961f75b6474940a89c9927ee599c8821828278fdd36a99
Opcode Fuzzy Hash: 073c9be414ffde32cdc7b6b7b6990915952fa3f290ac3694838aba6ee941b747
Instruction Fuzzy Hash: D0A2F374A04229CFCB64EF20D8597ADB7B6BB89305F1084E9D50AA7390DF349E86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05B35A94, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05B3B63B

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f02d97f5fe540a8ed303ca8c5fb39de84805e61d998f83880556cc55224c5c36
Instruction ID: ac088d64f8619dd84a9d96867f69705f977a8897218e1865bfb65834f8a6592a
Opcode Fuzzy Hash: f02d97f5fe540a8ed303ca8c5fb39de84805e61d998f83880556cc55224c5c36
Instruction Fuzzy Hash: 9F511271D002188FDB14CFA9C895BAEFBB1FF48314F15806AE816BB395DB74A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00D00A91, Relevance: 6.6, APIs: 4, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 9f4187f2bdb625764159b05958e317c0e73bc5b3c198351b3ae6a42a5a173c09
Instruction ID: dbaff8bd12c7232df799f69c4afd9ab80a91319e7549d30a03d3ae2c4b3310db
Opcode Fuzzy Hash: 9f4187f2bdb625764159b05958e317c0e73bc5b3c198351b3ae6a42a5a173c09
Instruction Fuzzy Hash: 4762D274A01229CFCB64DF20D85979DBBB6BB89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00AD6, Relevance: 6.6, APIs: 4, Instructions: 628libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f6d5904d50c87d3305030d41e2cfd2e39ee8b2acbc81b5fb866819a62c885919
Instruction ID: e5e6f036ce250522457f10949b9660364e0bd405a94230bb78a891b27d74f194
Opcode Fuzzy Hash: f6d5904d50c87d3305030d41e2cfd2e39ee8b2acbc81b5fb866819a62c885919
Instruction Fuzzy Hash: 7152D274A01229CFCB64DF20D85979DBBB6BB89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00B12, Relevance: 6.6, APIs: 4, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 630409b43a67b6b9028b68f9044329891d1030b7c1c2ed7238d8328425d6489a
Instruction ID: a28dfc3e7c7abde82f58007299aa599c417a75ccb8cf3ace56ed0108656e4fd9
Opcode Fuzzy Hash: 630409b43a67b6b9028b68f9044329891d1030b7c1c2ed7238d8328425d6489a
Instruction Fuzzy Hash: 4F52D274A012298FCB64DF20D85979DBBB6BF89305F2084E9D50AA7340DF349E82CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00B57, Relevance: 6.6, APIs: 4, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 12b4c7d67834832a90942959f4f3cb74d407086e8fcc54e9572db613f733da91
Instruction ID: 9c27d1d9d48b9ec369e6998cc2f7a9a682a912113d720dc134f4e98cb90f7161
Opcode Fuzzy Hash: 12b4c7d67834832a90942959f4f3cb74d407086e8fcc54e9572db613f733da91
Instruction Fuzzy Hash: D252E374A012298FCB64DF20D85979DBBB6BF89305F2084E9D50AA7340DF349E82CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00B9C, Relevance: 6.6, APIs: 4, Instructions: 609libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8ba88f5731620e95172303ef3f44a8cc402101e6d2dd6db81cb705f52da06cc0
Instruction ID: f9fae32746038a5f2de6272bf2561204f60d4eae3a004bb904a21b53dba2edcf
Opcode Fuzzy Hash: 8ba88f5731620e95172303ef3f44a8cc402101e6d2dd6db81cb705f52da06cc0
Instruction Fuzzy Hash: 4552E274A012298FCB64DF20D85979DBBB6BF89305F2084E9D50AA7340DF349E82CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00BE1, Relevance: 6.6, APIs: 4, Instructions: 602libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 973bd6c095fe57b883bb2779e993b1905c14c79c4be325b5cb6ceb2fe5b4e5f4
Instruction ID: 7f758d8d2d80a6ce8be5e23fd5e8812cd1b1bdb1eb7739f3e61aa91d5c20e2a9
Opcode Fuzzy Hash: 973bd6c095fe57b883bb2779e993b1905c14c79c4be325b5cb6ceb2fe5b4e5f4
Instruction Fuzzy Hash: 2152E374A012298FCB64DF20D85979DBBB6BF89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00C26, Relevance: 6.6, APIs: 4, Instructions: 595libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b5eba98a320376f6e7a632bc9ac47f0e6397ed8a5b5574c2613d509cfb66d2a6
Instruction ID: c6ba7f8c1bbebb3ebbd8c2945915b8d7e8699ac21367d815319167324777a8f6
Opcode Fuzzy Hash: b5eba98a320376f6e7a632bc9ac47f0e6397ed8a5b5574c2613d509cfb66d2a6
Instruction Fuzzy Hash: 1C52E274A012298FCB64EF20D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00C6B, Relevance: 6.6, APIs: 4, Instructions: 588libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cab54ae5a025830a78f4b031f7c3a248b2b8f15dd7d438b6e05c4e1b48e83fa3
Instruction ID: 5ea1e41378d90213dc80a316eab3d8164d231a58cebf3fa276a0f8f634dc5abb
Opcode Fuzzy Hash: cab54ae5a025830a78f4b031f7c3a248b2b8f15dd7d438b6e05c4e1b48e83fa3
Instruction Fuzzy Hash: BE52E274A012298FCB64EF20D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00CB0, Relevance: 6.6, APIs: 4, Instructions: 579libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 8699097292d2e092192eeb3378827b9ba9d395aa7ab14298acee21e119931a8b
Instruction ID: cbed81a27028c41eb928ad6515fe4540b42f9c7ae9772af1909bf74c19f411d2
Opcode Fuzzy Hash: 8699097292d2e092192eeb3378827b9ba9d395aa7ab14298acee21e119931a8b
Instruction Fuzzy Hash: E742E374A012298FCB64EF20D85979DB7B6BF89305F2084E9D50AA7340DF349E82CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00CEC, Relevance: 6.6, APIs: 4, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5083c60052144c30876ae765982d85963d6591fa9e5960cd5d64aaadb76a2ca5
Instruction ID: e3c02a584bf34cf72d545fdbfbf23b9ce2b381cb67286c4e203c5a53631bc513
Opcode Fuzzy Hash: 5083c60052144c30876ae765982d85963d6591fa9e5960cd5d64aaadb76a2ca5
Instruction Fuzzy Hash: E142E374A002298FCB64EF24D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00D31, Relevance: 6.6, APIs: 4, Instructions: 567libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 516556754214196e09777a36ddc3e4f60df90e035b27c05dc4bc4d487daf3cd7
Instruction ID: f4b7ea5198b2398b8e7472ab91bd4ecd2403ca73ff73da62d6128aab3add95c4
Opcode Fuzzy Hash: 516556754214196e09777a36ddc3e4f60df90e035b27c05dc4bc4d487daf3cd7
Instruction Fuzzy Hash: 2242F474A002298FCB64EF20D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D00D76, Relevance: 6.6, APIs: 4, Instructions: 560libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1f24663893b3cbf3efff5acf89a8acb8a2bfde80c51cab2108b3d7dd6b60f3b6
Instruction ID: fc44760b1db072955c0bcf71a0492700c45d857b5dc6a76198bd3d3aec4086d3
Opcode Fuzzy Hash: 1f24663893b3cbf3efff5acf89a8acb8a2bfde80c51cab2108b3d7dd6b60f3b6
Instruction Fuzzy Hash: C442F474A002298FCB64EF24D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00DBB, Relevance: 6.6, APIs: 4, Instructions: 553libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e6ba64a5443f218b4741f320735ebbc3cf7182fbf411dc7018be2c1008cd3ca1
Instruction ID: b8b3990c6330a536b971b248b18ccd43050e4eaa554cea3805d7ab52548d15e9
Opcode Fuzzy Hash: e6ba64a5443f218b4741f320735ebbc3cf7182fbf411dc7018be2c1008cd3ca1
Instruction Fuzzy Hash: 4742F474A012298FCB64EF24D85979DB7B6BF89305F2084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00E00, Relevance: 6.5, APIs: 4, Instructions: 546libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00E24
KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 40066707c8736d881c18403e21706cb88de10432a7bba2f98b83a189c83aa3b6
Instruction ID: 461734b3ac79528ff0ad3f29d23220bf3c2d229dc46664fdb649920ef463a6f7
Opcode Fuzzy Hash: 40066707c8736d881c18403e21706cb88de10432a7bba2f98b83a189c83aa3b6
Instruction Fuzzy Hash: 9142F474A002298FCB64EF24D85979DB7B6BF89305F2084E9D509A7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00E5B, Relevance: 5.0, APIs: 3, Instructions: 535libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: c69845e3693e85ff83dbab1d747edbdfd59af3a60e792b05341f6014e0cff958
Instruction ID: 9fce1bb5ec49732132d98334aa5f78fb20c8ed30407ede2640e4ffb4368c9f65
Opcode Fuzzy Hash: c69845e3693e85ff83dbab1d747edbdfd59af3a60e792b05341f6014e0cff958
Instruction Fuzzy Hash: 9242F474A012298FCB64EF24D85979DB7B6BF89305F1084E9D509A7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00EA0, Relevance: 5.0, APIs: 3, Instructions: 528libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: bc3f8d0c39577ba5b2339986a05cfb3cb3f5d30d5581299cc90a9fcddd6d99e4
Instruction ID: 3447ac10e1c4c6c8dccb0d66d595f2feaa28f8f91bc1767a89ea532eed98a0aa
Opcode Fuzzy Hash: bc3f8d0c39577ba5b2339986a05cfb3cb3f5d30d5581299cc90a9fcddd6d99e4
Instruction Fuzzy Hash: 3532F4B4A002298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00EE5, Relevance: 5.0, APIs: 3, Instructions: 521libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 4bc609002d41af684cf79a77b33d84969c2edb6a3698fa36194bc61a1df836f5
Instruction ID: 9520f95938b6be1fcbb70a6431ea697f74bb0152b0d86dabddc31c75c895dde7
Opcode Fuzzy Hash: 4bc609002d41af684cf79a77b33d84969c2edb6a3698fa36194bc61a1df836f5
Instruction Fuzzy Hash: 7832F5B4A012298FCB64EF24D85979DB7B6BF89305F1084E9D509A7380DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00F2A, Relevance: 5.0, APIs: 3, Instructions: 512libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 65cf1ad3f1c923ca1ad92a457f291c7d3444f3de3e61822f62b42e5c13cf5ac8
Instruction ID: e9e3e837a81a69dc00bfd7bab574564b68f76bdfa41b806ac2ccdd7370dcfe95
Opcode Fuzzy Hash: 65cf1ad3f1c923ca1ad92a457f291c7d3444f3de3e61822f62b42e5c13cf5ac8
Instruction Fuzzy Hash: 1132F6B4A012298FCB64EF24D85979DB7B6BF89305F1084E9D509A7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00F66, Relevance: 5.0, APIs: 3, Instructions: 507libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5b0817a3f8ead0c5b83d5551721c680ac4805f5948b44500ef307f9e50297c82
Instruction ID: 66f8375005274d7a5c0e6027bb8cc198ee399f9d7a75373d7c4bdd740685b00e
Opcode Fuzzy Hash: 5b0817a3f8ead0c5b83d5551721c680ac4805f5948b44500ef307f9e50297c82
Instruction Fuzzy Hash: B23206B4A012298FCB64EF24D85979DB7B6BF89305F1084E9D509A7380DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00FAB, Relevance: 5.0, APIs: 3, Instructions: 500libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D00FCF
LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: edc8a6b054f2182e5e8ce9bc9feaea846455934f08c9dffd09396cc54d2290e7
Instruction ID: 3da6b3ecf853945faf109a7b2a511cc03e26f9966527fb6f884c55234f94dffe
Opcode Fuzzy Hash: edc8a6b054f2182e5e8ce9bc9feaea846455934f08c9dffd09396cc54d2290e7
Instruction Fuzzy Hash: 2732F5B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D00FF0, Relevance: 3.5, APIs: 2, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e5235d491a669f878aeea3fe6c63dbfbf0145280c783cb1aa82fea3209aca5bd
Instruction ID: 717390e91c23d39d31190d02562e0aac6c4b73e6d3d36d3d2fcfa41c7297dec7
Opcode Fuzzy Hash: e5235d491a669f878aeea3fe6c63dbfbf0145280c783cb1aa82fea3209aca5bd
Instruction Fuzzy Hash: C532F5B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D01035, Relevance: 3.5, APIs: 2, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: d50588c819353cf725e5347dba9962d6e39950db582a497a4e7028ed043e918f
Instruction ID: d82774a9a2f195bcf91171ee2d94760a27a473b77d1a341b45f563a802d1b800
Opcode Fuzzy Hash: d50588c819353cf725e5347dba9962d6e39950db582a497a4e7028ed043e918f
Instruction Fuzzy Hash: 2922F5B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D0107A, Relevance: 3.5, APIs: 2, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 65f117565e7bdc9c42f773a17ddcb2759b2c9b6e6bf228d342ae54a389211196
Instruction ID: 7c309ebf4179439e00210557a32b4731ea9ae84d9c6b94293479a449c223fc7d
Opcode Fuzzy Hash: 65f117565e7bdc9c42f773a17ddcb2759b2c9b6e6bf228d342ae54a389211196
Instruction Fuzzy Hash: CF2206B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D010BF, Relevance: 3.5, APIs: 2, Instructions: 472libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 2a00141bde728df622bdbe5677bbcfbccb1a81a12e7eda1bcb82591e67097ea4
Instruction ID: 5260a66345106b6d65db1bd726a3b4716955d12892b65f29407a6b1bf359dce9
Opcode Fuzzy Hash: 2a00141bde728df622bdbe5677bbcfbccb1a81a12e7eda1bcb82591e67097ea4
Instruction Fuzzy Hash: 852206B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D509A7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D01104, Relevance: 3.5, APIs: 2, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: c2cb8ff3b45e3406b81cfddda1930533f7f07991311907a1af37f636ee095bfd
Instruction ID: dbebd513e598ccbb8202ba21eca644bb9dbbfcf85ae148ce518d5a53008dba42
Opcode Fuzzy Hash: c2cb8ff3b45e3406b81cfddda1930533f7f07991311907a1af37f636ee095bfd
Instruction Fuzzy Hash: 6E2206B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D509A7380DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D01149, Relevance: 3.5, APIs: 2, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 0961cbeb2bf371ec50069ccca529d3631f7caff2d74e8a445777e28e230138c4
Instruction ID: 82bff5ebc0fdd52754626f33b1cf1517329414e913145a2fb78aeced491a8686
Opcode Fuzzy Hash: 0961cbeb2bf371ec50069ccca529d3631f7caff2d74e8a445777e28e230138c4
Instruction Fuzzy Hash: 052206B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D01191, Relevance: 3.5, APIs: 2, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D012E3
KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 4ade5d8933a007e084ca0cb799cc04809c0019d80eb24a46331affbb97d4931f
Instruction ID: 678376a648f7e96ab043c318b94ced913a7c324cacf19113cfdd862e339af6ef
Opcode Fuzzy Hash: 4ade5d8933a007e084ca0cb799cc04809c0019d80eb24a46331affbb97d4931f
Instruction Fuzzy Hash: 9E2205B4A042298FCB64EF24D85979DB7B6BF89305F1084E9D50AA7340DF349E86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00D0163C, Relevance: 1.8, APIs: 1, Instructions: 279COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b3940c5ccaa3007fcaa257fa6d23c9a737410a62d53622ac7415af748f83177b
Instruction ID: 78a25c5e0c7bd631b38326c92348b14dc78273e78a0b38741722120cf1d4a606
Opcode Fuzzy Hash: b3940c5ccaa3007fcaa257fa6d23c9a737410a62d53622ac7415af748f83177b
Instruction Fuzzy Hash: E4D106B4A00229CBCB24DF20D8547ADB7B6BF89305F6084E9D609A7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D01684, Relevance: 1.8, APIs: 1, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d49cee0572d3b3002c3fa71d20a41a1234a414cdc93df717c81206b1bf1fd06a
Instruction ID: 7a49c65ecc53c3507d92fc7c57002b2578c7974a050240526667cadac0cd07dd
Opcode Fuzzy Hash: d49cee0572d3b3002c3fa71d20a41a1234a414cdc93df717c81206b1bf1fd06a
Instruction Fuzzy Hash: B1C107B4A01229CBCB64DF24D8547ADB7B6BF89305F2084E9D609A7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D016C0, Relevance: 1.8, APIs: 1, Instructions: 265COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4c71887f793aff64e2fd08aa7a133c5d8a962dbef1cb60606a1b7cd8710c5c94
Instruction ID: af7b30a8409fd717c3001df2c8e1e5cddcc14d1c0230c1310595296985a2e055
Opcode Fuzzy Hash: 4c71887f793aff64e2fd08aa7a133c5d8a962dbef1cb60606a1b7cd8710c5c94
Instruction Fuzzy Hash: 6CC1F8B4A00229CBCB64DF24D85479DB7B6BF89305F2084E9D609A7341DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D01708, Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00D01723

Memory Dump Source

Source File: 00000006.00000002.600114881.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5b1765ae9c4ff3df1c47b3f61895f7833a88e59a8d60af380a469161e365b360
Instruction ID: a9320a716d61c3a1bd5cf17faf0a7fe1b4c6e0cbaf06c571f0208fe6d06841d1
Opcode Fuzzy Hash: 5b1765ae9c4ff3df1c47b3f61895f7833a88e59a8d60af380a469161e365b360
Instruction Fuzzy Hash: C2C119B4A00229CBCB64DF24D8547ADB7B6BF89305F2084E9D609A7340DF349E86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0274500F, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0037c9c2b8dcdbd7698b82a08b9bc28379dcec27f1995c52e1dfd7958fef03a
Instruction ID: 362b6f67e86beed8e0faee8621296ff55ce5ac051658dbc3846743bee442988d
Opcode Fuzzy Hash: c0037c9c2b8dcdbd7698b82a08b9bc28379dcec27f1995c52e1dfd7958fef03a
Instruction Fuzzy Hash: D9611FB1C04249AFDF01CFA9C884ACDBFB1FF49304F25816AE908AB220DB359945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05B3B4F4, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05B3B63B

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a29a7e9c31a77967c9c62a36125e1436849e68023c014eb0a78e920405c11e3f
Instruction ID: d1ba5e344ad74a99143af996c86fd15c762def34828838455f2f94adf25eeef6
Opcode Fuzzy Hash: a29a7e9c31a77967c9c62a36125e1436849e68023c014eb0a78e920405c11e3f
Instruction Fuzzy Hash: 015132B1D002188FDB04CFA9C896BEDBBB1FF48314F15806AE816BB395D774A844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05B3921C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05B3B63B

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 77a6a14ccb34222989f058099df4842d828f3ca359f711d9556db8396e7857c9
Instruction ID: 7df65618f723ff1a3fba885e5bc6e5460d79240f4b146fc808bc891ae5cf569f
Opcode Fuzzy Hash: 77a6a14ccb34222989f058099df4842d828f3ca359f711d9556db8396e7857c9
Instruction Fuzzy Hash: 50511271D002188FDB14CFA9C895BADFBB1FF48314F15806AE816BB395DB74A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02743567, Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027451A2

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 46771faedfdd92841bd8c33373b16246547b0c02940be99b97163602b866aa42
Instruction ID: d5313afbc43a33349d5b4f4602b11cb380347c699c1e6a727a424ca908491cd2
Opcode Fuzzy Hash: 46771faedfdd92841bd8c33373b16246547b0c02940be99b97163602b866aa42
Instruction Fuzzy Hash: 6D51D2B1D10309DFDB14CFA9C884ADEBBB5FF58314F64812AE819AB210DB74A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02743574, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027451A2

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 745c804834d434e6151704940ef75b9940a955eff17a63a9f0532fa6f6593592
Instruction ID: 5f25255089b3180683c66f81ac5b837cad78a39057c5ea155d49e7492ab52624
Opcode Fuzzy Hash: 745c804834d434e6151704940ef75b9940a955eff17a63a9f0532fa6f6593592
Instruction Fuzzy Hash: 2351A3B1D10349DFDB14CFA9C884ADEBBB5FF48314F64812AE819AB210D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02745084, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027451A2

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6b97c8d6e3a5bfcb099cd724e13aa4ddf3c0b73e2d91639eee327bf358c3c1ea
Instruction ID: d41bf2658e789acf013d2c2eeb0bca33b2362ab5627c2bab7642bc837c62d737
Opcode Fuzzy Hash: 6b97c8d6e3a5bfcb099cd724e13aa4ddf3c0b73e2d91639eee327bf358c3c1ea
Instruction Fuzzy Hash: B151C0B5D10309DFDF14CFA9C880ADEBBB5BF98314F64812AE819AB250DB749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0274779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02747F09

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 38abd402571de99abf16c05e9023c553bd8d43899497cca06fcb39003ef4839e
Instruction ID: bcbc27391731d6057e29cbe3c5a4bfd2929578c72d8a6966a4e80df1edefce49
Opcode Fuzzy Hash: 38abd402571de99abf16c05e9023c553bd8d43899497cca06fcb39003ef4839e
Instruction Fuzzy Hash: F3413AB5A002458FDB14CF99C488AAAFBF5FF89314F258559E419AB321C734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05B3CE2D, Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 05B3CEC0

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: ac7a0b1874a4390f4617b82f39dc698487c4b5fb15e27f6db431fdb87cc1c7f3
Instruction ID: 69f50e05acdd06f0b2a120f1b264283887264a38df777f643530d73f2950f353
Opcode Fuzzy Hash: ac7a0b1874a4390f4617b82f39dc698487c4b5fb15e27f6db431fdb87cc1c7f3
Instruction Fuzzy Hash: 5331F2B09016599FDB10CF99C985BCEBBF1AF48318F248059E005BB790C7B46949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05B3C820, Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 05B3CEC0

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0da2270e8fe7a59fd824eaf3c39af82c6cc41f415e3fff0c489481cc8e46dcfd
Instruction ID: 01841f9badf729f78bc5b4aca0cd82787bb06cec896b5ab201342b50a6369038
Opcode Fuzzy Hash: 0da2270e8fe7a59fd824eaf3c39af82c6cc41f415e3fff0c489481cc8e46dcfd
Instruction Fuzzy Hash: 5F3102B0D016589FDB10CF99C985BDEBBF5AF48318F248059E005BB390D7B4A849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0274651C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02746B2E,?,?,?,?,?), ref: 02746BEF

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 500bbb22d64d44def313e203d99c34269fd7d0970bb7f791f503024a070e5091
Instruction ID: a8b657d13f386ac2daa3a04bfea391f595d744154fe02b4c4525b65a555288bb
Opcode Fuzzy Hash: 500bbb22d64d44def313e203d99c34269fd7d0970bb7f791f503024a070e5091
Instruction Fuzzy Hash: 1B2105B5D002489FDB10CFA9D584ADEBBF8EB48324F14841AE914A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B39228, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,05B3C127), ref: 05B3C1BF

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9080c4ee353dcaadac4b4be53621508f8866f14d30d00efd73786bdbe20b593a
Instruction ID: f5270d2b43af848ea25f52bd279c37c7fb482879fc7108f772871a046ddae2e5
Opcode Fuzzy Hash: 9080c4ee353dcaadac4b4be53621508f8866f14d30d00efd73786bdbe20b593a
Instruction Fuzzy Hash: 5B21DEB18043488FCB10DFA9C884BDEBBF4EF49220F24854AE519B7350D774A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02746B61, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02746B2E,?,?,?,?,?), ref: 02746BEF

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 959d5c478a473646c051590ab57c517c3ed90709ed61f16d2d7e418f29c1fcb2
Instruction ID: 4ce2d38b11156390bb8ae667801cb543b1f85a5669eee4fe66c49ed13465e6f6
Opcode Fuzzy Hash: 959d5c478a473646c051590ab57c517c3ed90709ed61f16d2d7e418f29c1fcb2
Instruction Fuzzy Hash: 912120B5D00208DFCB00CFA9D584ADEBBF8FB48324F14842AE918A3310D778A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0274C1A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0274C222

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: f11ba05b68f2f70492a8a3b6db7bb240496c90658a1bf6dbb03278c7bd87f220
Instruction ID: 98bb8b1842d99b85b5ae44fc0c98b1ee6630d2bf5d433bf99306ab287bb887d2
Opcode Fuzzy Hash: f11ba05b68f2f70492a8a3b6db7bb240496c90658a1bf6dbb03278c7bd87f220
Instruction Fuzzy Hash: F1119AB19013058FCB10EFAAD50879EBBF4FB49714F20852AD405B7744CB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0274C1A1, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0274C222

Memory Dump Source

Source File: 00000006.00000002.600374738.0000000002740000.00000040.00000001.sdmp, Offset: 02740000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1af4d589155ecaeda52e9a3760f779658b039df5e359f927ade0d70577c91507
Instruction ID: ad5bfefee575da4c56d1844dc2c84340283ab4ab1d08482398186ad6a631d8cf
Opcode Fuzzy Hash: 1af4d589155ecaeda52e9a3760f779658b039df5e359f927ade0d70577c91507
Instruction Fuzzy Hash: 122197B59013068FCB10EFAAD10839EBBF4FB48714F24852AD909B7345CB38A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B3C158, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,05B3C127), ref: 05B3C1BF

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5d74f886a9dd067eb0939dfeff42cd8cc5d50f637017b623bf7267efc1bfba41
Instruction ID: 7efbf662f3115fd1b9527fb63ec5fd56637bb103ed4373012a2784559cbc6660
Opcode Fuzzy Hash: 5d74f886a9dd067eb0939dfeff42cd8cc5d50f637017b623bf7267efc1bfba41
Instruction Fuzzy Hash: 801125B19006488FCB10DFAAC885BDEBBF8EF48324F25845AE519B7700C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B3924C, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,05B3C127), ref: 05B3C1BF

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e18232860dd9a1261305867a1869afdc5de965b85acf76d41ac0275a23139df6
Instruction ID: 7ad1eb3877bcc29e6c52e073b05bb7bbd74e9526185c03ea085d5010a9e3da5d
Opcode Fuzzy Hash: e18232860dd9a1261305867a1869afdc5de965b85acf76d41ac0275a23139df6
Instruction Fuzzy Hash: E31125B59046498FCB10DFAAC849B9EBBF4EF48324F24845AE519B7300C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B3CCE8, Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05B3CD45

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f773513ab8c35a99d775b5d7f201785da812e64f4af3c707140c82f3f8bcfdd3
Instruction ID: e5272b070391581d0026fc2b332c006762c8b0d0a694664ffeb9ea0cffb3c4d0
Opcode Fuzzy Hash: f773513ab8c35a99d775b5d7f201785da812e64f4af3c707140c82f3f8bcfdd3
Instruction Fuzzy Hash: 061112B58002498FCB10DFAAD486BCEBFF8EB48324F14855AE519B7700C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05B3C70C, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05B3CD45

Memory Dump Source

Source File: 00000006.00000002.605239582.0000000005B30000.00000040.00000001.sdmp, Offset: 05B30000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f6d274d02213e6d5df861ad889d64fba20344e17bb0fe86f9e73115f3246660c
Instruction ID: 29d22266f40a4f2dd608492d3d5bfd8bd20c9c77b8ce4e6637a8ba17e7434f5d
Opcode Fuzzy Hash: f6d274d02213e6d5df861ad889d64fba20344e17bb0fe86f9e73115f3246660c
Instruction Fuzzy Hash: C81103B59042498FCB10DFAAD445B9EBFF4EB48224F14845AE519B7710C778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.599545188.0000000000B9D000.00000040.00000001.sdmp, Offset: 00B9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec6b73dd71217e2eed3db95920bd86f7e51468451fd4ebefde6975753bb4876
Instruction ID: b9b8cd2e257eb8576e8fa12fe34d0eeee319b399f4f1467eebc80a2b671d766d
Opcode Fuzzy Hash: 9ec6b73dd71217e2eed3db95920bd86f7e51468451fd4ebefde6975753bb4876
Instruction Fuzzy Hash: 692103B1504240DFDF10DF14D9C0B27BBA5FB98328F2485B9E9094B346C336E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BAD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.599591481.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386a3ed199c9880eaed7a009c59df344cc5514933549307b7d32e77bcb9e6d17
Instruction ID: bd379994448176aad807efe664f7dc0bacc0bc99aea378833a9be35b30ad7ef8
Opcode Fuzzy Hash: 386a3ed199c9880eaed7a009c59df344cc5514933549307b7d32e77bcb9e6d17
Instruction Fuzzy Hash: 6C2134B1508240DFCB20DF24D8D0B26BBA5FB89314F34C6ADE84A4B686C736D807CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BAD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.599591481.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa40ab02c2a530d17843bf3780def2b356ba4ad15cf0d6f4c0aa570ed531fcc
Instruction ID: 5ba19a3c37ed356dfcd136c0f7cafec2f8e63c871bf10fe858b199141f5fd4f0
Opcode Fuzzy Hash: 3fa40ab02c2a530d17843bf3780def2b356ba4ad15cf0d6f4c0aa570ed531fcc
Instruction Fuzzy Hash: 2721967550D3808FDB12CF20D5A4B15BFB1EB46314F28C5DAD8498B657C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.599545188.0000000000B9D000.00000040.00000001.sdmp, Offset: 00B9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4244a9aae6d80b52576d8183ab5a55eec2a15cebe5e8ad83433696fc3d306fb5
Instruction ID: 3a775086b7a2fbac2b643bd1dcbd0255873e1eb9070c0c9a756fe988bb8b0415
Opcode Fuzzy Hash: 4244a9aae6d80b52576d8183ab5a55eec2a15cebe5e8ad83433696fc3d306fb5
Instruction Fuzzy Hash: 2D11B176804280CFDF11CF14D5C4B16BFB1FB94324F24C6A9D8090B616C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report INV01562.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back