Play interactive tour

Edit tour

Analysis Report 7XCBqj5HLqHcRlU.exe

Overview

General Information

Sample Name:	7XCBqj5HLqHcRlU.exe
Analysis ID:	404247
MD5:	09a25586d2eaf5e8c3a5df5557bad218
SHA1:	33acc64a84386fc9b14c9b389f7fc7f4fad089e6
SHA256:	e34725603d4f0177a6fbb66cff9f073a90cd74e6a65c05f1a704ab390906474f
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains very large array initializations

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

7XCBqj5HLqHcRlU.exe (PID: 5452 cmdline: 'C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe' MD5: 09A25586D2EAF5E8C3A5DF5557BAD218)

7XCBqj5HLqHcRlU.exe (PID: 5628 cmdline: {path} MD5: 09A25586D2EAF5E8C3A5DF5557BAD218)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "security@prisamexico.netOpy44Yi.e65ymail.prisamexico.net"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5628	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5452	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "security@prisamexico.netOpy44Yi.e65ymail.prisamexico.net"}

Multi AV Scanner detection for submitted file

Show sources

Source: 7XCBqj5HLqHcRlU.exe

ReversingLabs: Detection: 21%

Machine Learning detection for sample

Show sources

Source: 7XCBqj5HLqHcRlU.exe

Joe Sandbox ML: detected

Source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: global traffic

TCP traffic: 192.168.2.3:49737 -> 66.199.141.105:587

Source: Joe Sandbox View

ASN Name: COGECO-PEER1CA COGECO-PEER1CA

Source: global traffic

TCP traffic: 192.168.2.3:49737 -> 66.199.141.105:587

Source: unknown

DNS traffic detected: queries for: mail.prisamexico.net

Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	String found in binary or memory: http://hDgEgh.com
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.479342187.0000000002CB8000.00000004.00000001.sdmp	String found in binary or memory: http://mail.prisamexico.net
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.479342187.0000000002CB8000.00000004.00000001.sdmp	String found in binary or memory: http://prisamexico.net
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.479080463.0000000002C80000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.479428427.0000000002CE4000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	String found in binary or memory: http://yjaeXK8No5PRZuzN.net
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b870E16F5u002dC16Eu002d43D1u002d9988u002dCA3FEBA36821u007d/u0037F0C032Au002dCECDu002d45E6u002d921Du002d6A85A13FF474.cs

Large array initialization: .cctor: array initializer size 11940

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 0_2_0106C43C	0_2_0106C43C
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 0_2_0106E4C3	0_2_0106E4C3
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 0_2_0106E4D0	0_2_0106E4D0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E264A0	4_2_00E264A0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E2B518	4_2_00E2B518
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E798B0	4_2_00E798B0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E72268	4_2_00E72268
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E75473	4_2_00E75473
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E74D60	4_2_00E74D60
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E7A0F0	4_2_00E7A0F0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E70040	4_2_00E70040
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E73D08	4_2_00E73D08
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E7BEB8	4_2_00E7BEB8
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00E79FF1	4_2_00E79FF1
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_010746A0	4_2_010746A0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_010745D0	4_2_010745D0
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_0107D980	4_2_0107D980

Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.247598798.0000000007350000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.247475971.0000000007130000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSmartFormat.dll8 vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.233718688.000000000082E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTCUtRTle7N3X8OP.exeR vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235179785.0000000002B61000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAxZYHnoYYqlcSsXCcXMUUWAhXRXrJEGEfCeKt.exe4 vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000000.232750303.000000000060E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTCUtRTle7N3X8OP.exeR vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474947402.0000000000E30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameAxZYHnoYYqlcSsXCcXMUUWAhXRXrJEGEfCeKt.exe4 vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.471950386.00000000007A8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474731974.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 7XCBqj5HLqHcRlU.exe
Source: 7XCBqj5HLqHcRlU.exe	Binary or memory string: OriginalFilenameTCUtRTle7N3X8OP.exeR vs 7XCBqj5HLqHcRlU.exe

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7XCBqj5HLqHcRlU.exe.log

Jump to behavior

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 7XCBqj5HLqHcRlU.exe	Binary or memory string: SELECT DoctorId FROM PatientDoctor WHERE PatientId = {0};
Source: 7XCBqj5HLqHcRlU.exe	Binary or memory string: SELECT * FROM Patients a INNER JOIN PatientDoctor b ON a.Id = b.PatientId WHERE b.DoctorId = {0} ORDER BY LastName;
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.233519767.0000000000732000.00000002.00020000.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000000.232672737.0000000000512000.00000002.00020000.sdmp	Binary or memory string: SELECT * FROM Patients a INNER JOIN PatientDoctor b ON a.Id = b.PatientId WHERE b.DoctorId = {0} ORDER BY LastName;oSELECT COUNT(*) FROM PatientDoctor WHERE DoctorId = {0}sSELECT DoctorId FROM PatientDoctor WHERE PatientId = {0};

Source: 7XCBqj5HLqHcRlU.exe

ReversingLabs: Detection: 21%

Source: 7XCBqj5HLqHcRlU.exe

String found in binary or memory: Administrators/addNewToolStripMenuItem

Source: unknown	Process created: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe 'C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe'
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process created: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe {path}
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process created: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 7XCBqj5HLqHcRlU.exe

Static PE information: 0xF520A8BD [Wed Apr 28 01:17:49 2100 UTC]

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00EDD95C push eax; ret	4_2_00EDD95D
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_00EDE333 push eax; ret	4_2_00EDE349
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_0107E4D0 push es; retf	4_2_0107E4E6
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Code function: 4_2_01078B6D pushad ; retf	4_2_01078B8B

Source: initial sample

Static PE information: section name: .text entropy: 7.14608942237

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5452, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Window / User API: threadDelayed 2875			Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Window / User API: threadDelayed 6985			Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe TID: 5448	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe TID: 5076	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe TID: 2172	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe TID: 5924	Thread sleep count: 2875 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe TID: 5924	Thread sleep count: 6985 > 30	Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 7XCBqj5HLqHcRlU.exe, 00000000.00000002.235502993.0000000002BA4000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Code function: 4_2_00E72268 LdrInitializeThunk,

4_2_00E72268

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Memory written: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Process created: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe {path}

Jump to behavior

Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.475671852.0000000001460000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.475671852.0000000001460000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.475671852.0000000001460000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: 7XCBqj5HLqHcRlU.exe, 00000004.00000002.475671852.0000000001460000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5628, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5452, type: MEMORY
Source: Yara match	File source: 0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5628, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5628, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7XCBqj5HLqHcRlU.exe PID: 5452, type: MEMORY
Source: Yara match	File source: 0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7XCBqj5HLqHcRlU.exe.3ea1480.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing2	DCSync	System Information Discovery114	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7XCBqj5HLqHcRlU.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
7XCBqj5HLqHcRlU.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.7XCBqj5HLqHcRlU.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://prisamexico.net	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://mail.prisamexico.net	0%	Avira URL Cloud	safe
http://yjaeXK8No5PRZuzN.net	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://hDgEgh.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
prisamexico.net	66.199.141.105	true	true		unknown
mail.prisamexico.net	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.letsencrypt.org0	7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.tiro.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://prisamexico.net	7XCBqj5HLqHcRlU.exe, 00000004.00000002.479342187.0000000002CB8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://r3.i.lencr.org/0	7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://mail.prisamexico.net	7XCBqj5HLqHcRlU.exe, 00000004.00000002.479342187.0000000002CB8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://yjaeXK8No5PRZuzN.net	7XCBqj5HLqHcRlU.exe, 00000004.00000002.479080463.0000000002C80000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.479428427.0000000002CE4000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://r3.o.lencr.org0	7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.fonts.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://hDgEgh.com	7XCBqj5HLqHcRlU.exe, 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	7XCBqj5HLqHcRlU.exe, 00000000.00000002.246783403.0000000005B30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	7XCBqj5HLqHcRlU.exe, 00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp, 7XCBqj5HLqHcRlU.exe, 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://cps.root-x1.letsencrypt.org0	7XCBqj5HLqHcRlU.exe, 00000004.00000002.474443610.0000000000D1C000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.199.141.105	prisamexico.net	Canada		13768	COGECO-PEER1CA	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404247
Start date:	04.05.2021
Start time:	20:44:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7XCBqj5HLqHcRlU.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 41 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 2.20.157.220, 104.42.151.234, 52.255.188.83, 23.57.80.111, 20.82.210.154, 2.20.142.209, 2.20.142.210, 92.122.213.194, 92.122.213.247, 20.54.26.129, 20.49.157.6 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/404247/sample/7XCBqj5HLqHcRlU.exe

Simulations

Behavior and APIs

Time	Type	Description
20:45:59	API Interceptor	715x Sleep call for process: 7XCBqj5HLqHcRlU.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
COGECO-PEER1CA	generated check 662732.xlsm	Get hash	malicious	Browse	64.34.68.10
	4JQil8gLKd	Get hash	malicious	Browse	185.33.5.160
	Radix_1_exe.exe	Get hash	malicious	Browse	209.15.37.6
	Missed +443547900.wav - 45551 PM.htm.htm	Get hash	malicious	Browse	76.74.184.111
	#Ud83d#UdcdeMissed +60475998.wav - 82218 PM.htm	Get hash	malicious	Browse	76.74.184.111
	#Ud83d#UdcdeMissed +1957636658.wav - 63542 PM.htm.htm	Get hash	malicious	Browse	76.74.184.111
	z2xQEFs54b.exe	Get hash	malicious	Browse	76.74.184.61
	IMG-03-14-2021.exe	Get hash	malicious	Browse	69.90.160.170
	QUOTATION 03112021.exe	Get hash	malicious	Browse	69.90.160.170
	QUOTATION 03112021.exe	Get hash	malicious	Browse	69.90.160.170
	QUOTATION 03102021.exe	Get hash	malicious	Browse	69.90.160.170
	Avis de Paiement (1).xlsx	Get hash	malicious	Browse	66.155.71.149
	Agency Appointment - MV Patagonia.doc	Get hash	malicious	Browse	69.90.160.10
	remittanceslip_pdf.exe	Get hash	malicious	Browse	209.15.37.6
	New_Order.exe	Get hash	malicious	Browse	69.90.160.170
	tS9P6wPz9x.exe	Get hash	malicious	Browse	66.155.35.240
	ransomware.exe	Get hash	malicious	Browse	66.155.35.240
	ransomware.exe	Get hash	malicious	Browse	66.155.35.240
	m9vk5iD1xh.exe	Get hash	malicious	Browse	69.90.160.170

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7XCBqj5HLqHcRlU.exe.log Download File
Process:	C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.139562078643783
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	7XCBqj5HLqHcRlU.exe
File size:	1027584
MD5:	09a25586d2eaf5e8c3a5df5557bad218
SHA1:	33acc64a84386fc9b14c9b389f7fc7f4fad089e6
SHA256:	e34725603d4f0177a6fbb66cff9f073a90cd74e6a65c05f1a704ab390906474f
SHA512:	f47e7aad5ec8bab9da67d38bc2c41af84a7ee2ae25ae8d65b1430d0c516afbead11828113986250c48a1d71e6e05a19aca914075443236c565232c3cde361670
SSDEEP:	12288:WTbB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMa46ZSLmFbD:WI6ZS8toLAOAYKOVGNkulYP0tl
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... ...............0.............B.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4fc142
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xF520A8BD [Wed Apr 28 01:17:49 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfc0f0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfe000	0x604	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x100000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xfc0d4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfa148	0xfa200	False	0.619281179723	data	7.14608942237	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xfe000	0x604	0x800	False	0.33154296875	data	3.44527479652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xfe090	0x374	data
RT_MANIFEST	0xfe414	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	TCUtRTle7N3X8OP.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	HospitalManagementSystem
ProductVersion	1.0.0.0
FileDescription	HospitalManagementSystem
OriginalFilename	TCUtRTle7N3X8OP.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:47:40.708321095 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:40.843053102 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:40.843238115 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.093657017 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.093995094 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.229269028 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.229557991 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.365915060 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.400036097 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.547707081 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.547727108 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.547743082 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.547852993 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.555566072 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.690119028 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.737818956 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:41.872133970 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:41.874854088 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.009603977 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.010371923 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.145611048 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.146420956 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.282630920 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.283515930 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.419806004 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.420697927 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.557286024 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.563513994 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.563889027 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.564095974 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.564300060 CEST	49737	587	192.168.2.3	66.199.141.105
May 4, 2021 20:47:42.698018074 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.698143005 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.698236942 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:42.698370934 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:43.438055992 CEST	587	49737	66.199.141.105	192.168.2.3
May 4, 2021 20:47:43.491334915 CEST	49737	587	192.168.2.3	66.199.141.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:45:40.907846928 CEST	49199	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:40.958323956 CEST	53	49199	8.8.8.8	192.168.2.3
May 4, 2021 20:45:41.885293007 CEST	50620	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:41.944705963 CEST	53	50620	8.8.8.8	192.168.2.3
May 4, 2021 20:45:42.101284981 CEST	64938	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:42.152767897 CEST	53	64938	8.8.8.8	192.168.2.3
May 4, 2021 20:45:43.249723911 CEST	60152	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:43.300298929 CEST	53	60152	8.8.8.8	192.168.2.3
May 4, 2021 20:45:44.250201941 CEST	57544	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:44.299710035 CEST	53	57544	8.8.8.8	192.168.2.3
May 4, 2021 20:45:45.148391008 CEST	55984	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:45.199253082 CEST	53	55984	8.8.8.8	192.168.2.3
May 4, 2021 20:45:46.306448936 CEST	64185	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:46.357938051 CEST	53	64185	8.8.8.8	192.168.2.3
May 4, 2021 20:45:47.115859032 CEST	65110	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:47.173021078 CEST	53	65110	8.8.8.8	192.168.2.3
May 4, 2021 20:45:48.256779909 CEST	58361	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:48.318157911 CEST	53	58361	8.8.8.8	192.168.2.3
May 4, 2021 20:45:49.302977085 CEST	63492	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:49.354597092 CEST	53	63492	8.8.8.8	192.168.2.3
May 4, 2021 20:45:50.800856113 CEST	60831	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:50.849457979 CEST	53	60831	8.8.8.8	192.168.2.3
May 4, 2021 20:45:51.602194071 CEST	60100	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:51.653870106 CEST	53	60100	8.8.8.8	192.168.2.3
May 4, 2021 20:45:52.488270998 CEST	53195	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:52.537082911 CEST	53	53195	8.8.8.8	192.168.2.3
May 4, 2021 20:45:53.319747925 CEST	50141	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:53.371381998 CEST	53	50141	8.8.8.8	192.168.2.3
May 4, 2021 20:45:54.418693066 CEST	53023	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:54.469448090 CEST	53	53023	8.8.8.8	192.168.2.3
May 4, 2021 20:45:55.268682003 CEST	49563	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:55.321857929 CEST	53	49563	8.8.8.8	192.168.2.3
May 4, 2021 20:45:56.490590096 CEST	51352	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:56.550529003 CEST	53	51352	8.8.8.8	192.168.2.3
May 4, 2021 20:45:57.402920008 CEST	59349	53	192.168.2.3	8.8.8.8
May 4, 2021 20:45:57.460558891 CEST	53	59349	8.8.8.8	192.168.2.3
May 4, 2021 20:46:15.903362036 CEST	57084	53	192.168.2.3	8.8.8.8
May 4, 2021 20:46:15.963665009 CEST	53	57084	8.8.8.8	192.168.2.3
May 4, 2021 20:46:19.540618896 CEST	58823	53	192.168.2.3	8.8.8.8
May 4, 2021 20:46:19.589715958 CEST	53	58823	8.8.8.8	192.168.2.3
May 4, 2021 20:46:35.394798040 CEST	57568	53	192.168.2.3	8.8.8.8
May 4, 2021 20:46:35.454495907 CEST	53	57568	8.8.8.8	192.168.2.3
May 4, 2021 20:46:40.774811029 CEST	50540	53	192.168.2.3	8.8.8.8
May 4, 2021 20:46:40.840569973 CEST	53	50540	8.8.8.8	192.168.2.3
May 4, 2021 20:46:52.624903917 CEST	54366	53	192.168.2.3	8.8.8.8
May 4, 2021 20:46:52.681967020 CEST	53	54366	8.8.8.8	192.168.2.3
May 4, 2021 20:47:02.382545948 CEST	53034	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:02.454353094 CEST	53	53034	8.8.8.8	192.168.2.3
May 4, 2021 20:47:06.082418919 CEST	57762	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:06.147727013 CEST	53	57762	8.8.8.8	192.168.2.3
May 4, 2021 20:47:37.567984104 CEST	55435	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:37.633315086 CEST	53	55435	8.8.8.8	192.168.2.3
May 4, 2021 20:47:40.341852903 CEST	50713	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:40.495930910 CEST	53	50713	8.8.8.8	192.168.2.3
May 4, 2021 20:47:40.520329952 CEST	56132	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:40.596545935 CEST	58987	53	192.168.2.3	8.8.8.8
May 4, 2021 20:47:40.669444084 CEST	53	58987	8.8.8.8	192.168.2.3
May 4, 2021 20:47:40.685180902 CEST	53	56132	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 20:47:40.341852903 CEST	192.168.2.3	8.8.8.8	0x1ba7	Standard query (0)	mail.prisamexico.net	A (IP address)	IN (0x0001)
May 4, 2021 20:47:40.520329952 CEST	192.168.2.3	8.8.8.8	0xde31	Standard query (0)	mail.prisamexico.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2021 20:47:40.495930910 CEST	8.8.8.8	192.168.2.3	0x1ba7	No error (0)	mail.prisamexico.net	prisamexico.net		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:47:40.495930910 CEST	8.8.8.8	192.168.2.3	0x1ba7	No error (0)	prisamexico.net		66.199.141.105	A (IP address)	IN (0x0001)
May 4, 2021 20:47:40.685180902 CEST	8.8.8.8	192.168.2.3	0xde31	No error (0)	mail.prisamexico.net	prisamexico.net		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:47:40.685180902 CEST	8.8.8.8	192.168.2.3	0xde31	No error (0)	prisamexico.net		66.199.141.105	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2021 20:47:41.093657017 CEST	587	49737	66.199.141.105	192.168.2.3	220-r130.websiteservername.com ESMTP Exim 4.94.2 #2 Tue, 04 May 2021 13:47:41 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2021 20:47:41.093995094 CEST	49737	587	192.168.2.3	66.199.141.105	EHLO 888683
May 4, 2021 20:47:41.229269028 CEST	587	49737	66.199.141.105	192.168.2.3	250-r130.websiteservername.com Hello 888683 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 4, 2021 20:47:41.229557991 CEST	49737	587	192.168.2.3	66.199.141.105	STARTTLS
May 4, 2021 20:47:41.365915060 CEST	587	49737	66.199.141.105	192.168.2.3	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7XCBqj5HLqHcRlU.exe PID: 5452 Parent PID: 5764

General

Start time:	20:45:48
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe'
Imagebase:	0x730000
File size:	1027584 bytes
MD5 hash:	09A25586D2EAF5E8C3A5DF5557BAD218
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.241704135.0000000003DFF000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 7XCBqj5HLqHcRlU.exe PID: 5628 Parent PID: 5452

General

Start time:	20:46:00
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\7XCBqj5HLqHcRlU.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x510000
File size:	1027584 bytes
MD5 hash:	09A25586D2EAF5E8C3A5DF5557BAD218
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.471184243.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.476530485.0000000002A01000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 7XCBqj5HLqHcRlU.exe PID: 5452 Parent PID: 5764 7XCBqj5HLqHcRlU.exeCOMMON

Executed Functions

Function 010696F0, Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01069936

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 93967845634e5ee13e66d5f888558b1e9d1dff65a8e1e0dc1ab85681b586c384
Instruction ID: 1a2438687397c242822f78a59402d409b34a4b371143f8a1ea4f415173bb03f8
Opcode Fuzzy Hash: 93967845634e5ee13e66d5f888558b1e9d1dff65a8e1e0dc1ab85681b586c384
Instruction Fuzzy Hash: 7B715670A00B058FDB64DF2AD14479ABBF5BF88208F00892DE58ACBB40DB34E905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0106C69C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0106FD6A

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 24dd14f11c6329a90e66e2f4527d6f58daa4811024cb4d4541f3fb1a3683b913
Instruction ID: 25a46c79bc9b24b7b54bf41600b71d9c6220615d72bb2e9e0a5eedfdd93d3369
Opcode Fuzzy Hash: 24dd14f11c6329a90e66e2f4527d6f58daa4811024cb4d4541f3fb1a3683b913
Instruction Fuzzy Hash: 1751C0B1D003099FDB14DF9AD994ADEBFB5BF48314F24852AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0106FC4F, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0106FD6A

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 438b27a774966a712b10a73f5cb25f7a81a3fd0f5ad89edbaff9a138605a3fe9
Instruction ID: aa44f77e0b541697ed78d68e20b028feb911e8868918dfd4a39e894154b94b8e
Opcode Fuzzy Hash: 438b27a774966a712b10a73f5cb25f7a81a3fd0f5ad89edbaff9a138605a3fe9
Instruction Fuzzy Hash: 9E51C0B5D003099FDF14CFA9D994ADEBFB6BF48314F24852AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01065364, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01065421

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: abe52aed69238f16fa309581a90404888b51842aefbb95d5747438ffe4aaaa7b
Instruction ID: 7b0bed00c8a94bdd2a8eb46deb29fb5f1ea0df70c0f4bb8a51191cc2eaa75520
Opcode Fuzzy Hash: abe52aed69238f16fa309581a90404888b51842aefbb95d5747438ffe4aaaa7b
Instruction Fuzzy Hash: 8D411570D04218CFDF24DFA9C8447CEBBB5BF49309F2480A9D558AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01063DE4, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01065421

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e0620a37eedf527afe984f34a5bb5726b927bb34b8e257a1240a6bafb72662ac
Instruction ID: ed326faf23368e6207577ad39fbed67081242a9cdf3dad694d9a0a42c79fcc70
Opcode Fuzzy Hash: e0620a37eedf527afe984f34a5bb5726b927bb34b8e257a1240a6bafb72662ac
Instruction Fuzzy Hash: 934102B0D04318CFDF24DFA9C884B9EBBB5BF49308F2480A9D558AB251DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0106B21C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0106BBD6,?,?,?,?,?), ref: 0106BC97

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af6a12ae56b7b1bc69f94ea66afc4ed74600d305ca3d0aca4bd0e7603f95765f
Instruction ID: 00e674f1b6471acdd4d1a1d7bcc38c64edd616a55f5d47079f6e5ddb4f8fc01f
Opcode Fuzzy Hash: af6a12ae56b7b1bc69f94ea66afc4ed74600d305ca3d0aca4bd0e7603f95765f
Instruction Fuzzy Hash: D721E5B59002489FDB10CF9AD984ADEBBF8EB48324F14841AE954A3311D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0106BC08, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0106BBD6,?,?,?,?,?), ref: 0106BC97

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 843c95193b24e93cff584fae6f1a186bfc0ab6e58ec29a6acf900cd67b1cddb5
Instruction ID: ba004b3d020ba16008f65f74ccff7b195122c25a417078d4ba791485d1a3957b
Opcode Fuzzy Hash: 843c95193b24e93cff584fae6f1a186bfc0ab6e58ec29a6acf900cd67b1cddb5
Instruction Fuzzy Hash: CF21E3B5D002489FDB10CFA9D984BDEBBF8AB48324F15841AE954A7310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01069148, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010699B1,00000800,00000000,00000000), ref: 01069BC2

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f92988146727acd847ee2e93c8c628b0ddd2129b3c26d00a53e3d02f5f403c0a
Instruction ID: 5118a678b299ec921c433cb888c610425287b8c15d6b93ff8b44db0816d59447
Opcode Fuzzy Hash: f92988146727acd847ee2e93c8c628b0ddd2129b3c26d00a53e3d02f5f403c0a
Instruction Fuzzy Hash: 261126B6D003488FDB10DF9AD944BDEFBF8EB88324F54842AE555A7600C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01069B50, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010699B1,00000800,00000000,00000000), ref: 01069BC2

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a75d02acedcce9a310656a53c60479320d80d4e889a662fe3d55a743f619c49e
Instruction ID: c6283bf443c3ddc8ee1004c2a2a2d9c42c20e45a801a6ada213a2ac8eb8f4a4e
Opcode Fuzzy Hash: a75d02acedcce9a310656a53c60479320d80d4e889a662fe3d55a743f619c49e
Instruction Fuzzy Hash: AD1114B68002498FDB10CF9AC944ADEFBF8EB88324F15846AE555A7600C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010698D0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01069936

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 966418b2c440d4c3f9e1b21ee58657087b57f490d572cf540f58b4854e475d39
Instruction ID: c8c3101791d95e5f84ea455dc02a5fbe70c4d443204606c8d65436e77bee09cf
Opcode Fuzzy Hash: 966418b2c440d4c3f9e1b21ee58657087b57f490d572cf540f58b4854e475d39
Instruction Fuzzy Hash: 6311E0B5C006498FDB14DF9AC844BDEFBF8AB88224F14846AD569B7700D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234253598.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdaaf0fcd45be08146a482908f61f4fdc325dbe542ce69b1198da9e0a7c8a29
Instruction ID: c575f161230c3bb44da3bc39b3b42536b06bfd16105003a9fd6505840bc37a49
Opcode Fuzzy Hash: 9bdaaf0fcd45be08146a482908f61f4fdc325dbe542ce69b1198da9e0a7c8a29
Instruction Fuzzy Hash: 452125B2904380DFCB05DF14D9C0B26BF65FB98328F288569E9054B646C336D856EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234275255.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc0df3f9d856ce355133c597869762c82610de10b7565c0e87ccb9038b44be9
Instruction ID: 080b7b628d6f668e95965d8b40629cb5d9e6a82fd5ffda620b48fd676b9e0d28
Opcode Fuzzy Hash: dbc0df3f9d856ce355133c597869762c82610de10b7565c0e87ccb9038b44be9
Instruction Fuzzy Hash: 8021F875504248DFDB14DF14D4C0B26BB66FF84328F24C569EA094B25ACB36D847DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234275255.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0aff1a295cf458bea84d2f32f51b2d1a4daec740a75ac58c3d6f18e076a86a
Instruction ID: 4c284e099156e5c0e6449cbe154ba0c792464de97ee8f2be0214346ad445e0a3
Opcode Fuzzy Hash: cb0aff1a295cf458bea84d2f32f51b2d1a4daec740a75ac58c3d6f18e076a86a
Instruction Fuzzy Hash: E02107B1904208DFDB05DF14D9C0B36BB66FF84328F24C5ADEA094B256C736D846EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234275255.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ceaad01fe976c3beda40b740e27915e8d29e341fae81c4fe656cb83aa42a03
Instruction ID: 3ce208ec6864a9ea29c22f9a0a6de876423fc002a9fbf277052b043c0fe2651f
Opcode Fuzzy Hash: d7ceaad01fe976c3beda40b740e27915e8d29e341fae81c4fe656cb83aa42a03
Instruction Fuzzy Hash: 002183755093C48FCB02CF24D590715BF71EF46324F28C5EAD9458B667C73A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FED4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234253598.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction ID: e494d3d9a0d46c7d1686e19c55ea471ab405abdd8b4f96c22834d8efcc99789c
Opcode Fuzzy Hash: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction Fuzzy Hash: 3F11D376804380CFCB15CF14D9C4B16BF71FB94328F28C6A9D8450B616C336D85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234275255.0000000000FFD000.00000040.00000001.sdmp, Offset: 00FFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6bdbb04686500b4f88f9c2907b36233d3495acb1519a01dcdcc91fed9e3004
Instruction ID: 7831c5ae79843b5b9135790f278f3e6e03d2e67ef76f992a34d68b2eb8ad0789
Opcode Fuzzy Hash: aa6bdbb04686500b4f88f9c2907b36233d3495acb1519a01dcdcc91fed9e3004
Instruction Fuzzy Hash: F611BE75904284DFCB05CF10C5C0B25BB62FF84324F24C6AAD9494B666C33AD84ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED651, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234253598.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f804af7c340a58588817723d2fdf8ed2fcdc2af0996abe249110c464897999d0
Instruction ID: cc5fa9bad11ecc7c8fad7f5c6bdbbe007f903f14bf75f6619c138122acb33030
Opcode Fuzzy Hash: f804af7c340a58588817723d2fdf8ed2fcdc2af0996abe249110c464897999d0
Instruction Fuzzy Hash: C3012B724083849AE7209F27CC84767FBA8EF41338F188459FE0D5B682C3799C44E6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00FED650, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234253598.0000000000FED000.00000040.00000001.sdmp, Offset: 00FED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89882a36ef240502560005906c5a0ca5c4e1cf3f8157b19747f9bfad568162f1
Instruction ID: ad31b9f6d9102a7f7a1bd9931e759853f6a8e13dc0bef9ba34f963ef0ca28b7b
Opcode Fuzzy Hash: 89882a36ef240502560005906c5a0ca5c4e1cf3f8157b19747f9bfad568162f1
Instruction Fuzzy Hash: 19F0C2714042849AE7108F06CC84B62FFA8EB41334F18C45AED084B682C3789C44DAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0106E4D0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba3332351942467c458dbde6b274a83f6bb79a751eab875ed9cb5425df34ddf
Instruction ID: 58c4654bb097a9539b683da70a982870ba29c35dcf4cf61b9c3e22d7501d143e
Opcode Fuzzy Hash: 6ba3332351942467c458dbde6b274a83f6bb79a751eab875ed9cb5425df34ddf
Instruction Fuzzy Hash: 0412B3F5419B468BE330CF65EDD818DBBA1B745328F904208D2E12BAD9D7BE154ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 0106C43C, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df9c746795cda433d8cf04db77e4a7fc276a2786a73d8c5142098c366a1b771
Instruction ID: ba9e19c40bfa1f49068bfae93cd3ada5943ebfdd35f2c8c2758c6680ff86e367
Opcode Fuzzy Hash: 5df9c746795cda433d8cf04db77e4a7fc276a2786a73d8c5142098c366a1b771
Instruction Fuzzy Hash: 4DA1A132E0020ACFCF15DFA8C9445DDBBF6FF84300B1581AAE985BB225EB35A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0106E4C3, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.234571532.0000000001060000.00000040.00000001.sdmp, Offset: 01060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500d5a09e49bf7dc8b5418c5b8b894c8bd024c1b2877deeb563ae75cce8bf747
Instruction ID: 70187c08a5f200e3372664d379f9c204cd827cc56dc2d274fabd668c043498b3
Opcode Fuzzy Hash: 500d5a09e49bf7dc8b5418c5b8b894c8bd024c1b2877deeb563ae75cce8bf747
Instruction Fuzzy Hash: A6C118B18197468BD720DF65ECD818DBBB1BB85328F504318D2E16BAD8D7BE144ACF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7XCBqj5HLqHcRlU.exe PID: 5628 Parent PID: 5452 7XCBqj5HLqHcRlU.exeCOMMON

Executed Functions

Function 00E72268, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00E729F0

Memory Dump Source

Source File: 00000004.00000002.475058797.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 54ea6c70681080c76814d58752a588e4e1113ac7066965e9922bdc3a992c3f15
Instruction ID: f0e8883b6c73066f8dade210532db48be59778cb945e960f7bbc652eca4131af
Opcode Fuzzy Hash: 54ea6c70681080c76814d58752a588e4e1113ac7066965e9922bdc3a992c3f15
Instruction Fuzzy Hash: 72621931E016198FCB24EF78C9556DDB7F2AF89304F1085AAD54AAB360EF309E85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0107691F, Relevance: 6.1, APIs: 4, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 010769A0
GetCurrentThread.KERNEL32 ref: 010769DD
GetCurrentProcess.KERNEL32 ref: 01076A1A
GetCurrentThreadId.KERNEL32 ref: 01076A73

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7d30b1e1fde88a9bcf8cc1b03787ca521fce5cf0136f8d18f2d3bd5a7369ee79
Instruction ID: 91b95e1ade7335e9724b292266c2348f7d0593415950d281a93a60b86a2b9d38
Opcode Fuzzy Hash: 7d30b1e1fde88a9bcf8cc1b03787ca521fce5cf0136f8d18f2d3bd5a7369ee79
Instruction Fuzzy Hash: 5F5166B49057448FEB10DFAAC5887EEBFF0EF49314F24849AE089A7360C7355884CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01076940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 010769A0
GetCurrentThread.KERNEL32 ref: 010769DD
GetCurrentProcess.KERNEL32 ref: 01076A1A
GetCurrentThreadId.KERNEL32 ref: 01076A73

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d85fced449f6ac0379561bcc2c2546b97539c0045ac6326233f4e2437a04496f
Instruction ID: c1831adde20a2647ab8e36167adfc45231af3027b7bfb718f392266d8a0d9eb2
Opcode Fuzzy Hash: d85fced449f6ac0379561bcc2c2546b97539c0045ac6326233f4e2437a04496f
Instruction Fuzzy Hash: 5C5157B0D006498FEB14DFAAD548BEEBBF4EF88314F208499E549A7350D7355884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00E7E1E8, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475058797.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01dc85b01ed7ac9c3f87ac967c701af2c0a2a6df477c4ed46bc4bdd6f18b229
Instruction ID: 93564860fc81a41982e93b0621a9ae06bdc8d814b35ce3d5788521b76403b146
Opcode Fuzzy Hash: b01dc85b01ed7ac9c3f87ac967c701af2c0a2a6df477c4ed46bc4bdd6f18b229
Instruction Fuzzy Hash: 6D414371D083958FCB00DB79C8046AEBBF5AF89314F1585AAD408E7351EB789945CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 01075084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010751A2

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5bd2d20a2cd13678585f43a52d70d3f5b272a428f18dd85263ca0bf3ae6cc9b5
Instruction ID: 23552981583021c50cf251959663df4dd0cd00de929b32e7543b82895e78964e
Opcode Fuzzy Hash: 5bd2d20a2cd13678585f43a52d70d3f5b272a428f18dd85263ca0bf3ae6cc9b5
Instruction Fuzzy Hash: 0351CEB1D102489FDF14CFA9D884ADEBFB1BF88314F64852AE819AB250D7749885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01075090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010751A2

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9209a4c6edddae9c292623cb521618fe5b3ce71facc820e015f6660164ea2041
Instruction ID: ef62271b1cf85eb4497a673ebe6381a94188ae40df7d7f732a5ca5970f58dd71
Opcode Fuzzy Hash: 9209a4c6edddae9c292623cb521618fe5b3ce71facc820e015f6660164ea2041
Instruction Fuzzy Hash: A541D0B1D003489FDB14CFA9D884ADEBFB5BF88314F64852AE818AB210D7749885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0107779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01077F01

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 22c33418dca17274876dfad6ffcc63353f7270a1e1d09edf113a034c82571493
Instruction ID: 279a6fae808f4267e8450efa9841463a9540604e59750ee0d42e93f0a7bbf088
Opcode Fuzzy Hash: 22c33418dca17274876dfad6ffcc63353f7270a1e1d09edf113a034c82571493
Instruction Fuzzy Hash: 30410CB4D00345CFDB14CF59C488AAABBF5FF88314F148899E559A7311D774A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0107C109, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0107C192

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 55fba53977b03d76b8d0b09a8363c5ab6edaa7b515522ff445d5efd589f746bd
Instruction ID: cee0ba94cf2d09f173270ee0ee3acb2c25dd49f6fdd5a1fba9f7bdcca048da53
Opcode Fuzzy Hash: 55fba53977b03d76b8d0b09a8363c5ab6edaa7b515522ff445d5efd589f746bd
Instruction Fuzzy Hash: 6731F2B0C043868FEB21DF69E5493EEBFF0EB06318F2484AAD489A7642C7395409CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01076B63, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01076BEF

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e675575681ecad41243f9c4eb4e800f37ed059e05e0c68a665469a1084786de2
Instruction ID: 91afe82c924dc9ae40ca3967f41a7b4e6fb00d983fb54b5ed5aa10530338c0fd
Opcode Fuzzy Hash: e675575681ecad41243f9c4eb4e800f37ed059e05e0c68a665469a1084786de2
Instruction Fuzzy Hash: 2621E2B5D002489FDB10CFA9D984AEEBFF4EB48324F14845AE955A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01076B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01076BEF

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 14b0d0f34b9a548c5c698df1e64434518d7b49e5d07fdbcb13a923c06b544b0c
Instruction ID: 8e9274fc69a1111a2914ce6dc7bcc9037d37e4603fda13527c0f7fce33705103
Opcode Fuzzy Hash: 14b0d0f34b9a548c5c698df1e64434518d7b49e5d07fdbcb13a923c06b544b0c
Instruction Fuzzy Hash: F021F3B5D002489FDB10CFAAD984AEEFBF8FB48324F14841AE915A3310D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E265F8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,00E27819,00000800), ref: 00E278AA

Memory Dump Source

Source File: 00000004.00000002.474914361.0000000000E20000.00000040.00000001.sdmp, Offset: 00E20000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b3cc81d2dd742d9f0916bc0c23a0f148c119be072bc9bca46b3901ffb13c68e
Instruction ID: 9bdce94dd99992d57dc66e098431514036f0992227e6cf83c17d43bbd50d6bee
Opcode Fuzzy Hash: 4b3cc81d2dd742d9f0916bc0c23a0f148c119be072bc9bca46b3901ffb13c68e
Instruction Fuzzy Hash: 431114B6D042598FCB14DFAAD848BDEFBF4EB88324F14842AE555B7200C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E7E2BA, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,00E7E23A), ref: 00E7E327

Memory Dump Source

Source File: 00000004.00000002.475058797.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bc725795ec3d1c0797da6ac2f7357e28aa70e0629ee07354ece81459e9216428
Instruction ID: 6c6a84c96e1f488252b2411ae4fdaf5a073173acfc3207ac7482ef9fc36a5ca8
Opcode Fuzzy Hash: bc725795ec3d1c0797da6ac2f7357e28aa70e0629ee07354ece81459e9216428
Instruction Fuzzy Hash: A31133B1C046599FCB10DFAAC844BDEFBB4AF48324F15856AE418B7240D378A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00E7CD50, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,00E7E23A), ref: 00E7E327

Memory Dump Source

Source File: 00000004.00000002.475058797.0000000000E70000.00000040.00000001.sdmp, Offset: 00E70000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fab9154dd74b660405b301ae1fc171350193c6ed3a6fbc58e516361e7fc3025e
Instruction ID: 06fc6307787d282812f570f206b321ed90c7ad8b1cf204d127fa558eb57a574e
Opcode Fuzzy Hash: fab9154dd74b660405b301ae1fc171350193c6ed3a6fbc58e516361e7fc3025e
Instruction Fuzzy Hash: 0B1133B1C006599BCB10DFAAC444BDEFBF4AB48324F11856AE918B7300D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0107C118, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0107C192

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d76067b4dd706606d8be603b15bb6e9e45e35c9739d94931cc0867e9eaa1ffc9
Instruction ID: ba8657c49c0c7e28c39dc4930e1598bec80b6a8f2dd763554b9a9797cf77afc3
Opcode Fuzzy Hash: d76067b4dd706606d8be603b15bb6e9e45e35c9739d94931cc0867e9eaa1ffc9
Instruction Fuzzy Hash: 6011AFB1D003468FDB10EFA9D60839EBFF4FB45324F20886AD449A3601C7386504CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01073300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01074116

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ea39025747e160bdf9c2ee1f9818da431d4e9d935a94e7c8cb01fe948749216a
Instruction ID: 018daf1316bbbf66738a44537836cf8993d15cc8efc0615df52b5249d9d38133
Opcode Fuzzy Hash: ea39025747e160bdf9c2ee1f9818da431d4e9d935a94e7c8cb01fe948749216a
Instruction Fuzzy Hash: 281143B5D002498FCB20DF9AD844BDEFBF4EB88224F10846AE959B7600D374A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010740AB, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01074116

Memory Dump Source

Source File: 00000004.00000002.475491920.0000000001070000.00000040.00000001.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3e308c4de24856590537c232695e194d7d9cac6656837575abc6e207b315b290
Instruction ID: baa54913ac813ff145812f715707b94c7d9bdd3c5a81abbefaa3227c70c6bfe8
Opcode Fuzzy Hash: 3e308c4de24856590537c232695e194d7d9cac6656837575abc6e207b315b290
Instruction Fuzzy Hash: 8D1143B6D002498FDB10DFAAD444BDEFBF4EF89224F14846AD558B7600D374A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2A3E8, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00E2B355

Memory Dump Source

Source File: 00000004.00000002.474914361.0000000000E20000.00000040.00000001.sdmp, Offset: 00E20000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0cffc3a9ca2279cad31f048912fe6e0b192f948f7652e86f566c265b81e25adb
Instruction ID: 8984fc19256f305e23a77259d96f4399d688ae10d3adf35c00fe6c7c44b87196
Opcode Fuzzy Hash: 0cffc3a9ca2279cad31f048912fe6e0b192f948f7652e86f566c265b81e25adb
Instruction Fuzzy Hash: 661136B4C006488FCB10DF99D444BDEFBF8EB48324F108859E518B7200D3B4A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475214380.0000000000ECD000.00000040.00000001.sdmp, Offset: 00ECD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9b8eefb9ec98e596c70357c1ffce43cf7f1b4bf4529c0b3f7284d7b92db076
Instruction ID: f0f50bf5d2dc565eb67346913258871a97cb753e1bf4d0d83bce7e99348c1a1a
Opcode Fuzzy Hash: af9b8eefb9ec98e596c70357c1ffce43cf7f1b4bf4529c0b3f7284d7b92db076
Instruction Fuzzy Hash: 6B2121B1508200DFCB08DF10DAC0F27BB65FB88328F20857CEA055A206C337E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475214380.0000000000ECD000.00000040.00000001.sdmp, Offset: 00ECD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a439147b8123acc47ffa4bbf9f6bc1197319c5ca9d2414863741f6b197382a7
Instruction ID: f90878d95885811ce4e66baf539b40ef0e599da53ac8e8b11ec8d52b42cf0796
Opcode Fuzzy Hash: 3a439147b8123acc47ffa4bbf9f6bc1197319c5ca9d2414863741f6b197382a7
Instruction Fuzzy Hash: 5F21E0B1508244DFCB05DF14DAC0F26BB65FB98328F24857DE9055B246C337D856DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475251525.0000000000EDD000.00000040.00000001.sdmp, Offset: 00EDD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408efb14e8212e51a7b6e04edea479b089d3939ea84bc8f7b2045f2c432b6642
Instruction ID: e485ad281740f2202827c0729feed3e6c1cbc36846d7a3d15de57233fd0bea17
Opcode Fuzzy Hash: 408efb14e8212e51a7b6e04edea479b089d3939ea84bc8f7b2045f2c432b6642
Instruction Fuzzy Hash: A821F2B5508240DFCB14DF24DCC0B26BB66FBC8318F24C5AAE90A5B346C736D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475251525.0000000000EDD000.00000040.00000001.sdmp, Offset: 00EDD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2b3ff9115c8ce15a810c0bbb6f99990fb57550aa1a2698b02a713a8ca3a4a7
Instruction ID: 1856711fdc8aeca7108ca6527ff4a1f4f7a4daa7145df6a558789805825a746b
Opcode Fuzzy Hash: ac2b3ff9115c8ce15a810c0bbb6f99990fb57550aa1a2698b02a713a8ca3a4a7
Instruction Fuzzy Hash: F221717550D3808FCB12CF24D990715BF71EB46214F28C5EBD8458B657C33A984BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475214380.0000000000ECD000.00000040.00000001.sdmp, Offset: 00ECD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction ID: 3cf0282638baa49d4746805f27da72ef252fdc04465d6434dd7ed3db6edea2fc
Opcode Fuzzy Hash: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction Fuzzy Hash: CC11AF76508280CFCB15CF14DAC4B16BF71FB94328F2486ADD8051B616C337D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.475214380.0000000000ECD000.00000040.00000001.sdmp, Offset: 00ECD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction ID: 176013c0b1b11484c843708e8590d54e7360d00239b176fb875b94f258f83065
Opcode Fuzzy Hash: f3b157afdbb6b8f97dc596e66e634dfcbcf822356cd4e727a4141288e46826d7
Instruction Fuzzy Hash: 6111AF76504280CFCB02CF10DAC4B16BF62FB94328F2486ADD8495B616C33BD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 7XCBqj5HLqHcRlU.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre