Play interactive tour

Edit tour

Analysis Report invoice.exe

Overview

General Information

Sample Name:	invoice.exe
Analysis ID:	404248
MD5:	1a59efb27c11d1ae0959bf6661e23538
SHA1:	6c5513edcdbbec2e332601bc136c3bf293b257fd
SHA256:	35a971b8e884d2d443a0d998e1f5c86cac85fe32af0eac3ba3bd518580f26678
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

invoice.exe (PID: 6980 cmdline: 'C:\Users\user\Desktop\invoice.exe' MD5: 1A59EFB27C11D1AE0959BF6661E23538)

invoice.exe (PID: 6488 cmdline: C:\Users\user\Desktop\invoice.exe MD5: 1A59EFB27C11D1AE0959BF6661E23538)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "kxguy@chefoowork.comVttn8SluiOogmail.chefoowork.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: invoice.exe PID: 6488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: invoice.exe PID: 6488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: invoice.exe PID: 6980	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: invoice.exe PID: 6980	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.invoice.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice.exe.435f638.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.invoice.exe.435f638.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.invoice.exe.435f638.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "kxguy@chefoowork.comVttn8SluiOogmail.chefoowork.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: invoice.exe

ReversingLabs: Detection: 17%

Machine Learning detection for sample

Show sources

Source: invoice.exe

Joe Sandbox ML: detected

Source: 4.2.invoice.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 67.21.94.15:587

Source: Joe Sandbox View

IP Address: 67.21.94.15 67.21.94.15

Source: Joe Sandbox View

ASN Name: ST-BGPUS ST-BGPUS

Source: global traffic

TCP traffic: 192.168.2.4:49771 -> 67.21.94.15:587

Source: unknown

DNS traffic detected: queries for: mail.chefoowork.com

Source: invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://XMBduf.com
Source: invoice.exe, 00000004.00000002.914437799.0000000003214000.00000004.00000001.sdmp	String found in binary or memory: http://chefoowork.com
Source: invoice.exe, 00000004.00000002.914459791.000000000321C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: invoice.exe, 00000004.00000002.916821425.00000000069DD000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: invoice.exe, 00000004.00000002.914459791.000000000321C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: invoice.exe, 00000004.00000002.912327944.000000000117B000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: invoice.exe, 00000004.00000002.914437799.0000000003214000.00000004.00000001.sdmp	String found in binary or memory: http://mail.chefoowork.com
Source: invoice.exe, 00000004.00000002.912327944.000000000117B000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: invoice.exe, 00000000.00000002.669242244.0000000003251000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: invoice.exe, 00000000.00000003.648358482.000000000647C000.00000004.00000001.sdmp, invoice.exe, 00000000.00000003.648325032.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: invoice.exe	String found in binary or memory: http://www.churchsw.org/church-projector-project
Source: invoice.exe	String found in binary or memory: http://www.churchsw.org/repository/Bibles/
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: invoice.exe, 00000000.00000003.649460358.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/G
Source: invoice.exe, 00000000.00000003.650618133.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: invoice.exe, 00000000.00000003.650651642.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlx
Source: invoice.exe, 00000000.00000003.650506259.0000000006484000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: invoice.exe, 00000000.00000003.650173899.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.htmlx
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.commva
Source: invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comtl
Source: invoice.exe, 00000000.00000003.645807019.000000000648B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: invoice.exe, 00000000.00000003.645760203.000000000648B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comic3
Source: invoice.exe, 00000000.00000003.645760203.000000000648B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comnO
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: invoice.exe, 00000000.00000003.647422674.0000000006473000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: invoice.exe, 00000000.00000003.652670720.000000000647C000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: invoice.exe, 00000000.00000003.652670720.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmWl
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-i
Source: invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.krF
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: invoice.exe, 00000000.00000003.648325032.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com-e
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krH
Source: invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krN.TTF
Source: invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krormal
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: invoice.exe, 00000000.00000003.645972306.000000000648B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com:
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: invoice.exe, 00000000.00000003.651230932.000000000647C000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: invoice.exe, 00000000.00000003.647562258.0000000006473000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.4k
Source: invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: http://ynmdZVkfPM0WUw.com
Source: invoice.exe, 00000004.00000002.912327944.000000000117B000.00000004.00000020.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: invoice.exe, 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp, invoice.exe, 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: invoice.exe

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_030DC508	0_2_030DC508
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_030D9990	0_2_030D9990
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BA818	0_2_094BA818
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BBB38	0_2_094BBB38
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094B8A68	0_2_094B8A68
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094B0040	0_2_094B0040
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BB3D0	0_2_094BB3D0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BC4F8	0_2_094BC4F8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BF9C8	0_2_094BF9C8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BF9B8	0_2_094BF9B8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BA8DA	0_2_094BA8DA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_094BA8F5	0_2_094BA8F5
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_062D0006	0_2_062D0006
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_062D0040	0_2_062D0040
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F44000	4_2_00F44000
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F411DA	4_2_00F411DA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F46D78	4_2_00F46D78
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F40EB8	4_2_00F40EB8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F4D258	4_2_00F4D258
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F4ABD0	4_2_00F4ABD0
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F4B728	4_2_00F4B728
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F485C8	4_2_00F485C8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_00F48608	4_2_00F48608
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_01324800	4_2_01324800
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_0132D800	4_2_0132D800
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_01323EAA	4_2_01323EAA
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_01324770	4_2_01324770
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_0132C770	4_2_0132C770
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_013247F2	4_2_013247F2
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_06066C68	4_2_06066C68
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_060694F8	4_2_060694F8
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_06067538	4_2_06067538
Source: C:\Users\user\Desktop\invoice.exe	Code function: 4_2_06066920	4_2_06066920

Source: invoice.exe	Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000000.00000002.669279978.0000000003297000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs invoice.exe
Source: invoice.exe, 00000000.00000002.669279978.0000000003297000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamecnGfukCpwgWzTHdgcfRSzDlnINNQxEa.exe4 vs invoice.exe
Source: invoice.exe, 00000000.00000000.642709609.0000000000E02000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRijndaelManagedTransform.exeB vs invoice.exe
Source: invoice.exe, 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs invoice.exe
Source: invoice.exe, 00000000.00000002.676661632.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameIEFRAME.DLLD vs invoice.exe
Source: invoice.exe, 00000000.00000002.679786339.0000000007EF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs invoice.exe
Source: invoice.exe	Binary or memory string: OriginalFilename vs invoice.exe
Source: invoice.exe, 00000004.00000000.667219984.0000000000A82000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameRijndaelManagedTransform.exeB vs invoice.exe
Source: invoice.exe, 00000004.00000002.912231991.000000000114A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs invoice.exe
Source: invoice.exe, 00000004.00000002.912778657.00000000014D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs invoice.exe
Source: invoice.exe, 00000004.00000002.912754305.00000000014C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs invoice.exe
Source: invoice.exe, 00000004.00000002.912719072.00000000014B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs invoice.exe
Source: invoice.exe, 00000004.00000002.911180484.0000000000EF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs invoice.exe
Source: invoice.exe, 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamecnGfukCpwgWzTHdgcfRSzDlnINNQxEa.exe4 vs invoice.exe
Source: invoice.exe	Binary or memory string: OriginalFilenameRijndaelManagedTransform.exeB vs invoice.exe

Source: invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/1

Source: C:\Users\user\Desktop\invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice.exe.log

Jump to behavior

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\invoice.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: invoice.exe

ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\invoice.exe 'C:\Users\user\Desktop\invoice.exe'
Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe
Source: C:\Users\user\Desktop\invoice.exe	Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\invoice.exe

Code function: 4_2_0606A61F push es; iretd

4_2_0606A63C

Source: initial sample

Static PE information: section name: .text entropy: 7.62508857658

Source: C:\Users\user\Desktop\invoice.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6980, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\invoice.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\invoice.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	Window / User API: threadDelayed 1375			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Window / User API: threadDelayed 8478			Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe TID: 7016	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 6984	Thread sleep time: -100497s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 7012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 6928	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 6644	Thread sleep count: 1375 > 30	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe TID: 6644	Thread sleep count: 8478 > 30	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 100497	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: invoice.exe, 00000004.00000002.912327944.000000000117B000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Code function: 4_2_0606C6F8 KiUserExceptionDispatcher,LdrInitializeThunk,KiUserExceptionDispatcher,KiUserExceptionDispatcher,

4_2_0606C6F8

Source: C:\Users\user\Desktop\invoice.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\invoice.exe

Memory written: C:\Users\user\Desktop\invoice.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Process created: C:\Users\user\Desktop\invoice.exe C:\Users\user\Desktop\invoice.exe

Jump to behavior

Source: invoice.exe, 00000004.00000002.913031436.0000000001920000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: invoice.exe, 00000004.00000002.913031436.0000000001920000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: invoice.exe, 00000004.00000002.913031436.0000000001920000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: invoice.exe, 00000004.00000002.913031436.0000000001920000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Users\user\Desktop\invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Code function: 4_2_0606516C GetUserNameW,

4_2_0606516C

Source: C:\Users\user\Desktop\invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6488, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 4.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.435f638.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.435f638.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6488, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6488, type: MEMORY
Source: Yara match	File source: Process Memory Space: invoice.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 4.2.invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.435f638.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.invoice.exe.435f638.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping2	Query Registry1	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	Credentials in Registry1	Security Software Discovery211	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing3	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery114	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
invoice.exe	17%	ReversingLabs	ByteCode-MSIL.Packed.Generic
invoice.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.invoice.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
chefoowork.com	0%	Virustotal		Browse
mail.chefoowork.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com:	0%	Virustotal		Browse
http://www.tiro.com:	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr-i	0%	Avira URL Cloud	safe
http://www.fontbureau.commva	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://XMBduf.com	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://chefoowork.com	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fonts.comnO	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.churchsw.org/church-projector-project	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.krH	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sandoll.co.krormal	0%	Avira URL Cloud	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://ynmdZVkfPM0WUw.com	0%	Avira URL Cloud	safe
http://www.fonts.comic3	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cno.4k	0%	Avira URL Cloud	safe
http://www.churchsw.org/repository/Bibles/	0%	Avira URL Cloud	safe
http://mail.chefoowork.com	0%	Avira URL Cloud	safe
http://www.sandoll.co.krN.TTF	0%	Avira URL Cloud	safe
http://www.goodfont.co.krF	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htmWl	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comtl	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.sakkal.com-e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chefoowork.com	67.21.94.15	true	true	0%, Virustotal, Browse	unknown
mail.chefoowork.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.tiro.com:	invoice.exe, 00000000.00000003.645972306.000000000648B000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr-i	invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.commva	invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://XMBduf.com	invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.tiro.com	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://chefoowork.com	invoice.exe, 00000004.00000002.914437799.0000000003214000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	invoice.exe, 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/G	invoice.exe, 00000000.00000003.649460358.000000000647C000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	invoice.exe, 00000000.00000003.652670720.000000000647C000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comgrita	invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.comnO	invoice.exe, 00000000.00000003.645760203.000000000648B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	invoice.exe, 00000000.00000003.648358482.000000000647C000.00000004.00000001.sdmp, invoice.exe, 00000000.00000003.648325032.000000000647C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.churchsw.org/church-projector-project	invoice.exe	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	invoice.exe, 00000000.00000003.645807019.000000000648B000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sandoll.co.krH	invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sandoll.co.krormal	invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de	invoice.exe, 00000000.00000003.651230932.000000000647C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	invoice.exe, 00000000.00000002.669242244.0000000003251000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	invoice.exe, 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp, invoice.exe, 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://sectigo.com/CPS0	invoice.exe, 00000004.00000002.912327944.000000000117B000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ynmdZVkfPM0WUw.com	invoice.exe, 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comic3	invoice.exe, 00000000.00000003.645760203.000000000648B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cno.4k	invoice.exe, 00000000.00000003.647562258.0000000006473000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers/cabarga.htmlx	invoice.exe, 00000000.00000003.650651642.000000000647C000.00000004.00000001.sdmp	false		high
http://www.churchsw.org/repository/Bibles/	invoice.exe	false	Avira URL Cloud: safe	unknown
http://mail.chefoowork.com	invoice.exe, 00000004.00000002.914437799.0000000003214000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.krN.TTF	invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.krF	invoice.exe, 00000000.00000003.646701127.0000000006480000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	invoice.exe, 00000000.00000003.647422674.0000000006473000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htmWl	invoice.exe, 00000000.00000003.652670720.000000000647C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	invoice.exe, 00000000.00000003.650506259.0000000006484000.00000004.00000001.sdmp, invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	invoice.exe, 00000000.00000003.650618133.000000000647C000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comtl	invoice.exe, 00000000.00000002.669124554.0000000001910000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	invoice.exe, 00000000.00000002.677620808.0000000007702000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.htmlx	invoice.exe, 00000000.00000003.650173899.000000000647C000.00000004.00000001.sdmp	false		high
http://www.sakkal.com-e	invoice.exe, 00000000.00000003.648325032.000000000647C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.21.94.15	chefoowork.com	United States		46844	ST-BGPUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404248
Start date:	04.05.2021
Start time:	20:46:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	invoice.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 185 Number of non-executed functions: 6
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Excluded IPs from analysis (whitelisted): 13.64.90.137, 52.147.198.201, 2.20.157.220, 168.61.161.212, 20.50.102.62, 92.122.213.247, 92.122.213.194, 52.155.217.156, 20.54.26.129, 2.20.142.209, 2.20.142.210, 20.49.157.6 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:47:12	API Interceptor	749x Sleep call for process: invoice.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
67.21.94.15	ATuRNgegI7kl7Ua.exe	Get hash	malicious	Browse
	Vcv22W33OiwhO12.exe	Get hash	malicious	Browse
	Catalog.exe	Get hash	malicious	Browse
	5401628864_AWB_28002_2021-17-03 2.exe	Get hash	malicious	Browse
	AVISO CREDITO PAGPROV.exe	Get hash	malicious	Browse
	7070355.exe	Get hash	malicious	Browse
	OC_402981675.exe	Get hash	malicious	Browse
	OC_007943234.exe	Get hash	malicious	Browse
	QIznD4DaCkKgV4J.exe	Get hash	malicious	Browse
	U6ODBh62dJ0IYCK.exe	Get hash	malicious	Browse
	OC_8403754263563.exe	Get hash	malicious	Browse
	jc7xI20UOg.exe	Get hash	malicious	Browse
	xIpnl7dBEb.exe	Get hash	malicious	Browse
	rm1E9ZjuNd.exe	Get hash	malicious	Browse
	DHL Shipment Info.exe	Get hash	malicious	Browse
	RFQ.4414_122.exe	Get hash	malicious	Browse
	GimRyEHi4ONqTEe.exe	Get hash	malicious	Browse
	PO_2002837727_288772.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ST-BGPUS	ATuRNgegI7kl7Ua.exe	Get hash	malicious	Browse	67.21.94.15
	Vcv22W33OiwhO12.exe	Get hash	malicious	Browse	67.21.94.15
	Catalog.exe	Get hash	malicious	Browse	67.21.94.15
	SecuriteInfo.com.Trojan.DownloaderNET.160.29545.exe	Get hash	malicious	Browse	67.21.94.4
	Proforma Invoice.xlsx	Get hash	malicious	Browse	204.188.203.155
	RCS76393.exe	Get hash	malicious	Browse	104.160.174.177
	eQLPRPErea.exe	Get hash	malicious	Browse	64.32.22.102
	UTcQK0heAfGWTLw.exe	Get hash	malicious	Browse	64.32.22.102
	RFQ # 1014397402856.pdf.exe	Get hash	malicious	Browse	204.188.203.155
	BIOTECHPO960488580.exe	Get hash	malicious	Browse	205.144.171.210
	GJK-KAOHSIUNG-2101.xlsx	Get hash	malicious	Browse	205.144.171.138
	New Purchase Order.exe	Get hash	malicious	Browse	204.188.203.155
	9311-32400.pdf.exe	Get hash	malicious	Browse	45.58.190.82
	ssyrNaO6AP.dll	Get hash	malicious	Browse	70.39.99.196
	5401628864_AWB_28002_2021-17-03 2.exe	Get hash	malicious	Browse	67.21.94.15
	SPmG3TLdax.exe	Get hash	malicious	Browse	204.188.203.155
	RDAW-180-47D.exe	Get hash	malicious	Browse	64.32.22.102
	Doc_3847468364836483638463,pdf.exe	Get hash	malicious	Browse	170.178.168.203
	gV8xdP8bas.exe	Get hash	malicious	Browse	104.160.174.169
	DHL.INFORMATION.TRACKING.exe	Get hash	malicious	Browse	67.21.94.4

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice.exe.log Download File
Process:	C:\Users\user\Desktop\invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.612907586857075
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	invoice.exe
File size:	657408
MD5:	1a59efb27c11d1ae0959bf6661e23538
SHA1:	6c5513edcdbbec2e332601bc136c3bf293b257fd
SHA256:	35a971b8e884d2d443a0d998e1f5c86cac85fe32af0eac3ba3bd518580f26678
SHA512:	7edebf42e9c80b7de2b6e31bf6d997ac7bcb3b64aff48119a6eb6287cb43f3b810dd80238f39c1b83d64ab4dfce6bf9757b349d9255a890c06eeb588dc6b3cc8
SSDEEP:	12288:NGgJvG5+IQEOKMrkXAEcapHnZWa7lDrGeZ7J3UvnjK:MgJvDTEOKNXFpEA7Jk
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.............b.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4a1d62
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60912EF9 [Tue May 4 11:24:41 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa1d10	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9fd68	0x9fe00	False	0.795957229769	data	7.62508857658	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x424	0x600	False	0.289713541667	data	2.42756322043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa4000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xa2058	0x3c8	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Felix Jeyareuben 2012
Assembly Version	2.0.0.0
InternalName	RijndaelManagedTransform.exe
FileVersion	2.0
CompanyName	www.churchsw.org
LegalTrademarks	Church Software
Comments
ProductName	Church Projector
ProductVersion	2.0
FileDescription	Church Projector
OriginalFilename	RijndaelManagedTransform.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:48:55.886637926 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:56.079209089 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:56.079359055 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:56.438600063 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:56.439112902 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:56.631918907 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:56.632364988 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:56.827056885 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:56.874015093 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:56.903604984 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.106219053 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.106261969 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.106272936 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.106292963 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.106308937 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.106417894 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.106499910 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.111130953 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.148775101 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.342194080 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.389724016 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.683432102 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:57.877511978 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:57.878709078 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:58.071715117 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:58.072448015 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:58.306613922 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:58.501542091 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:58.502100945 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:58.693665028 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:58.694238901 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:58.925160885 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:58.925677061 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:59.117305994 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.119545937 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:59.119587898 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:59.119761944 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:59.119770050 CEST	49771	587	192.168.2.4	67.21.94.15
May 4, 2021 20:48:59.313139915 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.313165903 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.313178062 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.313189030 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.319694996 CEST	587	49771	67.21.94.15	192.168.2.4
May 4, 2021 20:48:59.374453068 CEST	49771	587	192.168.2.4	67.21.94.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2021 20:46:55.308562040 CEST	49714	53	192.168.2.4	8.8.8.8
May 4, 2021 20:46:55.357300997 CEST	53	49714	8.8.8.8	192.168.2.4
May 4, 2021 20:46:56.418832064 CEST	58028	53	192.168.2.4	8.8.8.8
May 4, 2021 20:46:56.478195906 CEST	53	58028	8.8.8.8	192.168.2.4
May 4, 2021 20:46:57.204322100 CEST	53097	53	192.168.2.4	8.8.8.8
May 4, 2021 20:46:57.261778116 CEST	53	53097	8.8.8.8	192.168.2.4
May 4, 2021 20:46:57.664890051 CEST	49257	53	192.168.2.4	8.8.8.8
May 4, 2021 20:46:57.733747005 CEST	53	49257	8.8.8.8	192.168.2.4
May 4, 2021 20:46:58.863512039 CEST	62389	53	192.168.2.4	8.8.8.8
May 4, 2021 20:46:58.913793087 CEST	53	62389	8.8.8.8	192.168.2.4
May 4, 2021 20:47:00.198642969 CEST	49910	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:00.250102997 CEST	53	49910	8.8.8.8	192.168.2.4
May 4, 2021 20:47:01.562326908 CEST	55854	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:01.614088058 CEST	53	55854	8.8.8.8	192.168.2.4
May 4, 2021 20:47:02.595196962 CEST	64549	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:02.643806934 CEST	53	64549	8.8.8.8	192.168.2.4
May 4, 2021 20:47:03.724561930 CEST	63153	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:03.773454905 CEST	53	63153	8.8.8.8	192.168.2.4
May 4, 2021 20:47:04.540361881 CEST	52991	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:04.591876984 CEST	53	52991	8.8.8.8	192.168.2.4
May 4, 2021 20:47:05.475644112 CEST	53700	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:05.534707069 CEST	53	53700	8.8.8.8	192.168.2.4
May 4, 2021 20:47:06.600827932 CEST	51726	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:06.663393974 CEST	53	51726	8.8.8.8	192.168.2.4
May 4, 2021 20:47:07.509717941 CEST	56794	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:07.558408022 CEST	53	56794	8.8.8.8	192.168.2.4
May 4, 2021 20:47:08.445209026 CEST	56534	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:08.493815899 CEST	53	56534	8.8.8.8	192.168.2.4
May 4, 2021 20:47:09.325426102 CEST	56627	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:09.376822948 CEST	53	56627	8.8.8.8	192.168.2.4
May 4, 2021 20:47:10.308964968 CEST	56621	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:10.357498884 CEST	53	56621	8.8.8.8	192.168.2.4
May 4, 2021 20:47:11.503861904 CEST	63116	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:11.554511070 CEST	53	63116	8.8.8.8	192.168.2.4
May 4, 2021 20:47:12.633982897 CEST	64078	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:12.682523966 CEST	53	64078	8.8.8.8	192.168.2.4
May 4, 2021 20:47:13.799525023 CEST	64801	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:13.849663019 CEST	53	64801	8.8.8.8	192.168.2.4
May 4, 2021 20:47:27.419760942 CEST	61721	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:27.469161034 CEST	53	61721	8.8.8.8	192.168.2.4
May 4, 2021 20:47:31.472867966 CEST	51255	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:31.535389900 CEST	53	51255	8.8.8.8	192.168.2.4
May 4, 2021 20:47:45.299133062 CEST	61522	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:45.420372009 CEST	53	61522	8.8.8.8	192.168.2.4
May 4, 2021 20:47:46.005215883 CEST	52337	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:46.302139997 CEST	53	52337	8.8.8.8	192.168.2.4
May 4, 2021 20:47:46.897455931 CEST	55046	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:46.954340935 CEST	53	55046	8.8.8.8	192.168.2.4
May 4, 2021 20:47:47.068720102 CEST	49612	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:47.126574039 CEST	53	49612	8.8.8.8	192.168.2.4
May 4, 2021 20:47:47.382806063 CEST	49285	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:47.592140913 CEST	53	49285	8.8.8.8	192.168.2.4
May 4, 2021 20:47:48.278194904 CEST	50601	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:48.330339909 CEST	53	50601	8.8.8.8	192.168.2.4
May 4, 2021 20:47:48.970706940 CEST	60875	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:49.030683041 CEST	53	60875	8.8.8.8	192.168.2.4
May 4, 2021 20:47:49.419503927 CEST	56448	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:49.479090929 CEST	53	56448	8.8.8.8	192.168.2.4
May 4, 2021 20:47:49.534406900 CEST	59172	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:49.591427088 CEST	53	59172	8.8.8.8	192.168.2.4
May 4, 2021 20:47:50.654434919 CEST	62420	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:50.713545084 CEST	53	62420	8.8.8.8	192.168.2.4
May 4, 2021 20:47:51.629568100 CEST	60579	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:51.678473949 CEST	53	60579	8.8.8.8	192.168.2.4
May 4, 2021 20:47:52.210251093 CEST	50183	53	192.168.2.4	8.8.8.8
May 4, 2021 20:47:52.261642933 CEST	53	50183	8.8.8.8	192.168.2.4
May 4, 2021 20:48:01.715611935 CEST	61531	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:01.772701979 CEST	53	61531	8.8.8.8	192.168.2.4
May 4, 2021 20:48:02.103682041 CEST	49228	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:02.162940025 CEST	53	49228	8.8.8.8	192.168.2.4
May 4, 2021 20:48:05.248570919 CEST	59794	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:05.307259083 CEST	53	59794	8.8.8.8	192.168.2.4
May 4, 2021 20:48:36.449769020 CEST	55916	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:36.499744892 CEST	53	55916	8.8.8.8	192.168.2.4
May 4, 2021 20:48:38.232959986 CEST	52752	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:38.292238951 CEST	53	52752	8.8.8.8	192.168.2.4
May 4, 2021 20:48:55.333537102 CEST	60542	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:55.543627024 CEST	53	60542	8.8.8.8	192.168.2.4
May 4, 2021 20:48:55.554277897 CEST	60689	53	192.168.2.4	8.8.8.8
May 4, 2021 20:48:55.766128063 CEST	53	60689	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 4, 2021 20:48:55.333537102 CEST	192.168.2.4	8.8.8.8	0xa05b	Standard query (0)	mail.chefoowork.com	A (IP address)	IN (0x0001)
May 4, 2021 20:48:55.554277897 CEST	192.168.2.4	8.8.8.8	0xb24e	Standard query (0)	mail.chefoowork.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 4, 2021 20:48:55.543627024 CEST	8.8.8.8	192.168.2.4	0xa05b	No error (0)	mail.chefoowork.com	chefoowork.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:48:55.543627024 CEST	8.8.8.8	192.168.2.4	0xa05b	No error (0)	chefoowork.com		67.21.94.15	A (IP address)	IN (0x0001)
May 4, 2021 20:48:55.766128063 CEST	8.8.8.8	192.168.2.4	0xb24e	No error (0)	mail.chefoowork.com	chefoowork.com		CNAME (Canonical name)	IN (0x0001)
May 4, 2021 20:48:55.766128063 CEST	8.8.8.8	192.168.2.4	0xb24e	No error (0)	chefoowork.com		67.21.94.15	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2021 20:48:56.438600063 CEST	587	49771	67.21.94.15	192.168.2.4	220-web2.changeip.com ESMTP Exim 4.94 #2 Tue, 04 May 2021 14:48:55 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 4, 2021 20:48:56.439112902 CEST	49771	587	192.168.2.4	67.21.94.15	EHLO 123716
May 4, 2021 20:48:56.631918907 CEST	587	49771	67.21.94.15	192.168.2.4	250-web2.changeip.com Hello 123716 [84.17.52.3] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-STARTTLS 250 HELP
May 4, 2021 20:48:56.632364988 CEST	49771	587	192.168.2.4	67.21.94.15	STARTTLS
May 4, 2021 20:48:56.827056885 CEST	587	49771	67.21.94.15	192.168.2.4	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: invoice.exe PID: 6980 Parent PID: 5960

General

Start time:	20:47:02
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\invoice.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\invoice.exe'
Imagebase:	0xe00000
File size:	657408 bytes
MD5 hash:	1A59EFB27C11D1AE0959BF6661E23538
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.669341704.00000000032C2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.670894722.0000000004259000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: invoice.exe PID: 6488 Parent PID: 6980

General

Start time:	20:47:13
Start date:	04/05/2021
Path:	C:\Users\user\Desktop\invoice.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\invoice.exe
Imagebase:	0xa80000
File size:	657408 bytes
MD5 hash:	1A59EFB27C11D1AE0959BF6661E23538
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.913638464.0000000002EB1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.910976432.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: invoice.exe PID: 6980 Parent PID: 5960 invoice.exeCOMMON

Executed Functions

Function 062D0006, Relevance: 6.7, Instructions: 6714COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c786aa2f1fc59022fe08e4c759fdd9298d0dca0f4e32c9125c6d1f8483b3ac67
Instruction ID: aacb61d421714278c6519cc4c85fa04bfb46378adfc8db1480a2aeffd5e8c2e8
Opcode Fuzzy Hash: c786aa2f1fc59022fe08e4c759fdd9298d0dca0f4e32c9125c6d1f8483b3ac67
Instruction Fuzzy Hash: D4F3E934A51619CFC714DF74C898A99B7B1FF8A305F1195EAE50AAB361DB31AE80CF10

Uniqueness

Uniqueness Score: -1.00%

Function 062D0040, Relevance: 6.7, Instructions: 6697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7769e68eaf373ea0758a54f3088cf19e466bf868a1aefe2e5ea269f18e012bcc
Instruction ID: bac05f180c137e6cd66d2979fcd2a0f5ec17189d94a081527d427c89e6b755d7
Opcode Fuzzy Hash: 7769e68eaf373ea0758a54f3088cf19e466bf868a1aefe2e5ea269f18e012bcc
Instruction Fuzzy Hash: 2CF3E934A51619CFC714DF74C898A99B7B1FF8A305F1195EAE50AAB361DB31AE80CF10

Uniqueness

Uniqueness Score: -1.00%

Function 094BB3D0, Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

&`V9, xrefs: 094BB45E
pa], xrefs: 094BB56A
pa], xrefs: 094BB571

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID: &`V9$pa]$pa]
API String ID: 0-770036531
Opcode ID: e467f2aad4e1fe5259a9f92de931bde1782aa446fdef2c6f1c276d6828f098d0
Instruction ID: a36127c2aa72240c2c7a16b5b9b77a985365e50ceacf7b3cbbdce326ee889cbe
Opcode Fuzzy Hash: e467f2aad4e1fe5259a9f92de931bde1782aa446fdef2c6f1c276d6828f098d0
Instruction Fuzzy Hash: 9481B374E006188FDB08CFAAC9846DDFBB2FF88310F14802AD519AB354DB359946CF61

Uniqueness

Uniqueness Score: -1.00%

Function 094B0040, Relevance: 2.6, Instructions: 2589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4153764d9ba79d76bff0c01b9420eed2edd307b7a6be4ec40ba09d9b1c4ff483
Instruction ID: e1e5c68c76706aae2e5ea3050075b2a464afd5b506fdc72f0c60330c42b28160
Opcode Fuzzy Hash: 4153764d9ba79d76bff0c01b9420eed2edd307b7a6be4ec40ba09d9b1c4ff483
Instruction Fuzzy Hash: 23430E74A01219CFCB24DF68C998ADDB7B2BF89304F158196E419AB364DB34ED81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 094B8A68, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1824e433caec0b8fe85a13275d8413f0e51878e9dda2329141154f728fd150
Instruction ID: b92fb7a0eb380c5c2ea62bfef6aa287b81aa51fac451311d0e2e42b03e3867c5
Opcode Fuzzy Hash: 1f1824e433caec0b8fe85a13275d8413f0e51878e9dda2329141154f728fd150
Instruction Fuzzy Hash: 4B022970A00119DFCB14DF68C984AEEBBBABF88354F15846AF905EB361D771E841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 094BA818, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94a699160bd27ee42245c62a2c17289306f279d2e8b8b031316d3241adf78fc
Instruction ID: ef94675e92347b5ca958e715dae034a8af4ab29a71546d2d40522e7487061fc0
Opcode Fuzzy Hash: c94a699160bd27ee42245c62a2c17289306f279d2e8b8b031316d3241adf78fc
Instruction Fuzzy Hash: 85611D70E04219CFDB14CF6AC984A9EF7F6FF89214F15C1A6D409AB215D7309982CF61

Uniqueness

Uniqueness Score: -1.00%

Function 094BBB38, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999fe46e9e8862739e5bd555e51ba475c5c3dcab264e977b34ef2d99b4a2324a
Instruction ID: 6d3e4f1bc4ddc55ad100a08d554a71d64ff84f17bb897b8350082bbf7bc9e1f6
Opcode Fuzzy Hash: 999fe46e9e8862739e5bd555e51ba475c5c3dcab264e977b34ef2d99b4a2324a
Instruction Fuzzy Hash: B0510A74E146098FDB08CFAAC5516AEFBF2EF88340F14D06AD419B7254D7349A428FA4

Uniqueness

Uniqueness Score: -1.00%

Function 094BC4F8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77e71579cc17bc7c8f5a82bcb5cac283acc023fd5479f6e2a045d2eebc0124e
Instruction ID: a7d40f88e555145c171a561a1da6dbac2c51f26e5efd17b7747a1e906dd5a09a
Opcode Fuzzy Hash: d77e71579cc17bc7c8f5a82bcb5cac283acc023fd5479f6e2a045d2eebc0124e
Instruction Fuzzy Hash: AD31F7B1E006188BDB18CFAAD8447DEFBB6EFC8310F14C1AAD409AA354DB751A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 030DDB29, Relevance: 1.7, APIs: 1, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e21ceee8f5a9d5a65f86b24d4adde4354cda3bdc8b6e345d24e157d37d4882c
Instruction ID: b2ae78f7f60a19dfd445ff34bc23cd78c5c6a163b07d516baa5c3093ca3bd43c
Opcode Fuzzy Hash: 8e21ceee8f5a9d5a65f86b24d4adde4354cda3bdc8b6e345d24e157d37d4882c
Instruction Fuzzy Hash: B48149B1C0A3889FCF12CFA5C850ADDBFF1AF4A314F19809AE448AB262D3359945DF51

Uniqueness

Uniqueness Score: -1.00%

Function 030DBBC8, Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7d049a432fa4efba55fe7f5240765af3eb81e1f4ea111728435f9106a019a388
Instruction ID: 272a9b1e986a14ce1bf47282041bd6561e6a9bc59331a4e7d4d496560819ff9b
Opcode Fuzzy Hash: 7d049a432fa4efba55fe7f5240765af3eb81e1f4ea111728435f9106a019a388
Instruction Fuzzy Hash: 55714670A01B058FDB64DF2AD44079ABBF5FF88204F05892DD48AD7B50EB35E8458F91

Uniqueness

Uniqueness Score: -1.00%

Function 030DB214, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030DDD8A

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 435b6e4591553d9303b66ac1e12aa43d7a60f6751a5e1be2568a61a7dd44b2a0
Instruction ID: 616a2a20672be2fabf9389e25951c3983408f45ebc2f353e257dffd6dbbaab17
Opcode Fuzzy Hash: 435b6e4591553d9303b66ac1e12aa43d7a60f6751a5e1be2568a61a7dd44b2a0
Instruction Fuzzy Hash: 2D51ADB1D01349DFDB14CFA9C884ADEBBF5BF48310F24812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030DDC6D, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030DDD8A

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8c5b4f69768a290c8939cbec5ea8cac9d27906695b266c6983cf1c24dbbc94aa
Instruction ID: 745494671364edda20e1655203bce9cee404a55cc1aa2e1b9404e8eb140c3aca
Opcode Fuzzy Hash: 8c5b4f69768a290c8939cbec5ea8cac9d27906695b266c6983cf1c24dbbc94aa
Instruction Fuzzy Hash: CD51ADB1D01349DFDB14CFA9C984ADEBBF5BF48314F24812AE819AB210D7759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030D5874, Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c424dedb48b46531e39925f48b65981b4d0b7248a00f67735d1d621de6cd6b34
Instruction ID: b1ff20b22a542b02c6ed91328c670e78e856dd8047599c7bda9e34c14d9cef63
Opcode Fuzzy Hash: c424dedb48b46531e39925f48b65981b4d0b7248a00f67735d1d621de6cd6b34
Instruction Fuzzy Hash: 9541E3B28093489FDB01CFA9DC80BDEBFF4EF1A224F04449AE851A7752D3349804CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 030D6D49, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030D6D86,?,?,?,?,?), ref: 030D6E47

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b55fa4c772f406a9178448af21f73bed65228eb9dfdc4b72954e63a7b71b611c
Instruction ID: 4e417880f916655c62a593f4287679c78f83b7e0bd11155e7359a6bc29f567f5
Opcode Fuzzy Hash: b55fa4c772f406a9178448af21f73bed65228eb9dfdc4b72954e63a7b71b611c
Instruction Fuzzy Hash: 2941477690135CAFCF01CF99D844ADEBFF9EB49320F18805AE914A7220C735A914DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030DDE81, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,030DDEA8,?,?,?,?), ref: 030DDF1D

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 5afa8e5bf7d337bc17b73bf0cf9e8aba5e8527c6b99bf12217d515c0c3c73e64
Instruction ID: 1bdd53fa2d18ebdc40527653a8c0197efdafeec1d0361de0b3d60711019de784
Opcode Fuzzy Hash: 5afa8e5bf7d337bc17b73bf0cf9e8aba5e8527c6b99bf12217d515c0c3c73e64
Instruction Fuzzy Hash: DA2189B6801349DFCB10DFA8E945BDEBBF4EF58314F09844AE458AB211D335A908CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030DF888, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 030DF927

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 3b02391a49fcf362178f43116fb6625bab78e44c3c602081eac000fa69d376f7
Instruction ID: d7e596817e68a8915f33487f12b0290a5779e499fef98a20c114743cb1b6bb17
Opcode Fuzzy Hash: 3b02391a49fcf362178f43116fb6625bab78e44c3c602081eac000fa69d376f7
Instruction Fuzzy Hash: 9931D4B5D0130A9FDB10DF99D884ADEFBF4AB48224F14842AE815A7710D774A545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 030DF890, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 030DF927

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 5dc52bbf934d49f61c8c385f0b93126314a7cad81a12cdc72c94ce208f8e0799
Instruction ID: 9c76eff1e92c28a5ea874f5afe7061c34b20510952861e46bd1fb5386e0a2270
Opcode Fuzzy Hash: 5dc52bbf934d49f61c8c385f0b93126314a7cad81a12cdc72c94ce208f8e0799
Instruction Fuzzy Hash: 9E21E2B5D0130A9FCB10CF9AD880ADEFBF4AB48224F14842AE419A7610C774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030D5864, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030D6D86,?,?,?,?,?), ref: 030D6E47

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5387985cd47dd8f6445371655e3da338d1bfee01eec4412abaa8a553d96093df
Instruction ID: 3f7803747bd09ad4a8c6c990d991db2149c30f578e9333c8ac4d3d3f32c8c710
Opcode Fuzzy Hash: 5387985cd47dd8f6445371655e3da338d1bfee01eec4412abaa8a553d96093df
Instruction Fuzzy Hash: BB21E3B59013489FDB10CFAAD884BDEBBF8EB48324F14841AE915A3710D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030D6DB8, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030D6D86,?,?,?,?,?), ref: 030D6E47

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: df947429e262e052e62d4551cbf1d1d33ccb14d62800c43f9c6a7088e4a9468d
Instruction ID: 4fbc4d71b91dd65a176e4447d95a4daa4bede062eaf73de5e55465f3b02ca029
Opcode Fuzzy Hash: df947429e262e052e62d4551cbf1d1d33ccb14d62800c43f9c6a7088e4a9468d
Instruction Fuzzy Hash: CA21D2B59012099FDB10CFAAD884BDEBBF4EB48324F14841AE954A3710D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030DB0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,030DBE89,00000800,00000000,00000000), ref: 030DC09A

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: caa7b11e623f4c061915a99b650186edddfaf37a0e72f2c8b6656dd7ff4ac90f
Instruction ID: 2ad809c7ef5c384c34f5b3c98a651e26fa5d2db10436dcdac01cc56178c4ce2d
Opcode Fuzzy Hash: caa7b11e623f4c061915a99b650186edddfaf37a0e72f2c8b6656dd7ff4ac90f
Instruction Fuzzy Hash: A61114B29003098FDB20DF9AD844BDEFBF4EB48364F04842AD415A7610C375A949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 030DC028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,030DBE89,00000800,00000000,00000000), ref: 030DC09A

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1d18408669f614cee60d6b11732310fef73671dece196251d805c16cd96689d3
Instruction ID: 8ad01c0e74bd233031a91a759a562be2d5852a99b9c9bc2d53b907879b92da33
Opcode Fuzzy Hash: 1d18408669f614cee60d6b11732310fef73671dece196251d805c16cd96689d3
Instruction Fuzzy Hash: 7A1144B2C003098FDB20CF9AD844BDEFBF4AB48320F04851AD415A7610C375A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030DB080, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,030DBBDB), ref: 030DBE0E

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 743e6c3318976c042c76d88b799180445f642a03e40eafc033d99ff60fc4b160
Instruction ID: 381c69b62069aeb23ab0b17fa94cfa78ad4dd3b8768d36c954821088a6b49183
Opcode Fuzzy Hash: 743e6c3318976c042c76d88b799180445f642a03e40eafc033d99ff60fc4b160
Instruction Fuzzy Hash: A611F0B29017498FDB10CF9AC444BDEFBF4EF48224F15842AD819A7610D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030DB24C, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,030DDEA8,?,?,?,?), ref: 030DDF1D

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 42eb0883b45b4559fb0fcbb908377a34863e21f9a4946644e72147800036e184
Instruction ID: 55b91d6071d5bda248b0ab3dabd70ecf9f12d2681e7faccecd5b014a3a475dd6
Opcode Fuzzy Hash: 42eb0883b45b4559fb0fcbb908377a34863e21f9a4946644e72147800036e184
Instruction Fuzzy Hash: C811F2B59007099FDB10DF9AD484BDEBBF8EB48320F14841AE955A7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062DC764, Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

, xrefs: 062DF60E

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ed5094a25ba1be674307975530238369a7bf58e16bd3106575d37e6dce0d7ed2
Instruction ID: 9a3dd4e1d85901d09dfdbd4e4f52d2f7dacab7f9a952486ce8b580b55457504a
Opcode Fuzzy Hash: ed5094a25ba1be674307975530238369a7bf58e16bd3106575d37e6dce0d7ed2
Instruction Fuzzy Hash: B9514771A1020ACFCB50CF69D98469ABBF2FF88314F14C62AE819A7350E730E951CF94

Uniqueness

Uniqueness Score: -1.00%

Function 062D8371, Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

U, xrefs: 062D837C

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 69887870f683079db8a5783980ae6d5200cb7a02cccda9cc0d8d0e3fb3f571b6
Instruction ID: 3911a251a9e4da904d9483d180b97fbdeb04c0bd8a892a8476e929e6bf7dfeca
Opcode Fuzzy Hash: 69887870f683079db8a5783980ae6d5200cb7a02cccda9cc0d8d0e3fb3f571b6
Instruction Fuzzy Hash: 0C31B171E242148FDB69EB74C4553AE7AF6EF88318F25443DD802A7244DB3D4844CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 062DDD30, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

@, xrefs: 062DDD62

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 38198ecf6cf777af091ac0725c577472d9dc19289c0d6593d988142619fd719c
Instruction ID: 0c0643a3918c00d2cde4294c66c0ff335d0d05865117484877f3c301ed39731d
Opcode Fuzzy Hash: 38198ecf6cf777af091ac0725c577472d9dc19289c0d6593d988142619fd719c
Instruction Fuzzy Hash: 202101B1B106159FCF956BB8888067EBBA9AF88304F1044BEDD19CB391DB35CC01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 094B49C0, Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

, xrefs: 094B4A1C

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f3951191e7d6f24b713c7db6fd498b263e61e732f3296d15732cf4a62c4437da
Instruction ID: cbaaebe1f591bb0e671d41a5a23a42213d04dc9ec7a9967221b08363de6b60aa
Opcode Fuzzy Hash: f3951191e7d6f24b713c7db6fd498b263e61e732f3296d15732cf4a62c4437da
Instruction Fuzzy Hash: 51310A71E142289BDF24CF6AD845BDEF7B6AF49340F0480AAE508AB351D7705981CF61

Uniqueness

Uniqueness Score: -1.00%

Function 062DDD22, Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

@, xrefs: 062DDD62

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a7a0cf1c0bf26b5bca1250e2773dd2de276888ea20f6cc06078dccff10fcb5c5
Instruction ID: c2ef00a70496cd52442833255393a417d3e58f1b6c1a96bdf9ca040ead184e1d
Opcode Fuzzy Hash: a7a0cf1c0bf26b5bca1250e2773dd2de276888ea20f6cc06078dccff10fcb5c5
Instruction Fuzzy Hash: 6711C271B10516AFCF956AA88C9067EB6B6EF88200F004079DD199B385CB31C945C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 094B78E8, Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f881fa34610bbbc3ce62414948def1d4843ed9c2aeac3ab2d30ea16d0334b053
Instruction ID: 5cd7a9e376a45fc6bb816423a53df8d784044c84fbb9a6368325302feadf3cbc
Opcode Fuzzy Hash: f881fa34610bbbc3ce62414948def1d4843ed9c2aeac3ab2d30ea16d0334b053
Instruction Fuzzy Hash: 7BF1C0307042159FDB199F64C8A8BBF77A6AFC8344F14846AE9068F790DF75DC428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B7F29, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1e527b4e587c75e720ee88b7f38943c5161e623a9bcb06cb89b0465c8efca9
Instruction ID: 3706362d1d9ee2e1f8b2bbe9d7df09842bff4aaa86df191082f996d17f4eaf21
Opcode Fuzzy Hash: ce1e527b4e587c75e720ee88b7f38943c5161e623a9bcb06cb89b0465c8efca9
Instruction Fuzzy Hash: 3D814B34A01606CFCB14CF69C8849EAB7BABF89394F15816AE516EB361D731EC41CB71

Uniqueness

Uniqueness Score: -1.00%

Function 062DAF50, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4a0b0ee2757c656d796f3408ef7ea7e5d65edab1d371a9eeb491a79e43e37d
Instruction ID: 52048f20629a42f9db9143da067ae6b48e29431c19e4db429c779579cbed8afa
Opcode Fuzzy Hash: 5d4a0b0ee2757c656d796f3408ef7ea7e5d65edab1d371a9eeb491a79e43e37d
Instruction Fuzzy Hash: 3C818B70E103198FDB14DFA9C894AEEBBF6BF89304F14812AD409AB350DB389945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062DDA88, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e4dcc428f527d180284d50e754bbf62ec465503ab258d2cd3976726d6363cd
Instruction ID: 3d7a7e3651946d8e1290515a731e8e87cbb4a557dc1287eed6ee95a8541491f5
Opcode Fuzzy Hash: 62e4dcc428f527d180284d50e754bbf62ec465503ab258d2cd3976726d6363cd
Instruction Fuzzy Hash: DC81B235B106098FDB54EFA8C884AAEB7F6FFC8314F158879D805AB351DB71A841CB94

Uniqueness

Uniqueness Score: -1.00%

Function 094B7005, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fbb6487de2f96878beb3d261f73e79e3c6837b47b0fbb825d75f3ae70071ba
Instruction ID: 1060ed5b5ee5ec10ae6c1d0f25816137fc24cbb2a8e1f7929235838e58ebc3de
Opcode Fuzzy Hash: b0fbb6487de2f96878beb3d261f73e79e3c6837b47b0fbb825d75f3ae70071ba
Instruction Fuzzy Hash: 5F71D2301493859FCB039F7898A41DA3F72FF82360F0540ABE9468F662E7B99816D771

Uniqueness

Uniqueness Score: -1.00%

Function 062DC7EC, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaca7a4cd356b81d90790d5ee408658410831bdd8311a1a1ab3b7ba7b459924
Instruction ID: 47e858aeb3d7542745d875fa8c88926dc0eb34f5ca35f2a1b8140c74befd8137
Opcode Fuzzy Hash: 1aaca7a4cd356b81d90790d5ee408658410831bdd8311a1a1ab3b7ba7b459924
Instruction Fuzzy Hash: C9619A70E206188FDB14CFA9C884BAEFBB5FF48314F15846DE815AB391DB74A805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B4AA9, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab990f37019fb3f8f8b51af21898d201047003db1f77d02a32acfce538f058cb
Instruction ID: d9dfed17ab6036be36159296ffc93a1218e265a5993b3e4db4655f4ca58d9420
Opcode Fuzzy Hash: ab990f37019fb3f8f8b51af21898d201047003db1f77d02a32acfce538f058cb
Instruction Fuzzy Hash: A5711E74A042198FDB14DFA8C890BAEB7B2FF89314F5584A5D908AB326D770DD81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 094B4F51, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b251899ca1d9e6e9c48123a57d3e195bb46d966ef258ed0829b9b0c511b5d3ae
Instruction ID: 4a7285c7e1ff65ae471195b57896db509c927e628d2020b2c619dbc4265cb86e
Opcode Fuzzy Hash: b251899ca1d9e6e9c48123a57d3e195bb46d966ef258ed0829b9b0c511b5d3ae
Instruction Fuzzy Hash: C4712C74A042598FCB04DFA8C880A9EFBB2BF49358F15C5A5E918DB356D730D881CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062D7AE8, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff3b5f18a7a5616cfc47aad5481c7d26ee9284de579226743e218537f780093
Instruction ID: 7907b4aac5d6065ebe9f512e475ea576b3c373ddaf7c94f5be66cd68e8481293
Opcode Fuzzy Hash: 8ff3b5f18a7a5616cfc47aad5481c7d26ee9284de579226743e218537f780093
Instruction Fuzzy Hash: 51617F31A1070ADFCB00DF68D444AAEBBB5FF85314F118559E91AAB260EF34AD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 062DAE04, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae124b91dd3a41ce7979ef503136693e116a916c38951fa5cf785cc56228e680
Instruction ID: ab773928e42bd3933eff5632e990aaedba8089ac41e692c1e2de407b43918a5e
Opcode Fuzzy Hash: ae124b91dd3a41ce7979ef503136693e116a916c38951fa5cf785cc56228e680
Instruction Fuzzy Hash: 7D5171B1E142059FCF50DFA9C814AAFBBF9EF88214F14852AE815E3350EB749905CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 094B9E60, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8508647371135322d83e67ad93cc3489093b52643e03aa27e24a824b36ef202b
Instruction ID: 9dff08aa892865a9958cb86edf4d77053017e9fb58a2711aa3adb1cedd0dd556
Opcode Fuzzy Hash: 8508647371135322d83e67ad93cc3489093b52643e03aa27e24a824b36ef202b
Instruction Fuzzy Hash: 404102317042149FCB199B64D8946EF7BF6EFC9358F14406AE60ADB390DF359C028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 062D8380, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76e0c8d6dc55880ce748ffc8faf4c897a89f9dbbff9166f3ad871f585fd9236
Instruction ID: 5cd295b6363c867d607814d60e75e2b472e042dfe73468280b57ff00ed543f84
Opcode Fuzzy Hash: c76e0c8d6dc55880ce748ffc8faf4c897a89f9dbbff9166f3ad871f585fd9236
Instruction Fuzzy Hash: DF4180B1E20214CFDBA4EBB4C4547ADBAB6EF88328F155439D802A7244DB394C81CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 094B3C28, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be76d2047ed05582fab193a630950ab1e0342785cc4d4c4dc65932508077be26
Instruction ID: 785137930fb81acb6800dedc712e5c1a1add9081412c7cbfb3c024290b78975b
Opcode Fuzzy Hash: be76d2047ed05582fab193a630950ab1e0342785cc4d4c4dc65932508077be26
Instruction Fuzzy Hash: 7C417F75E16219DFCB00DFEAD5949EDBBF4AB09340F10546AE816FB300E731AA429F64

Uniqueness

Uniqueness Score: -1.00%

Function 062DAE44, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b275adf6796904ff2774ddc98b718022d83e7445b21ed22fd0136d2f3d6eb9
Instruction ID: 2acea1b5c640d1bf64cf96c43bc755e0c9667c0dc4b4ef8de3ca538a2f97a130
Opcode Fuzzy Hash: 82b275adf6796904ff2774ddc98b718022d83e7445b21ed22fd0136d2f3d6eb9
Instruction Fuzzy Hash: 9D41E1B1D00609CFDB20DFAAC994ADEBBB5BF48305F258029D409BB250D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 062DB39E, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2281d645c957cd2c8f6049dc27b0230489e6ac9e4a27f432828afd73e728f56
Instruction ID: a595f9b34da7dfaef6171434338c02ba7b620e4338f8b7d7df1d4caf1a882af8
Opcode Fuzzy Hash: b2281d645c957cd2c8f6049dc27b0230489e6ac9e4a27f432828afd73e728f56
Instruction Fuzzy Hash: 2441E2B1D00609CFDB20DFAAC994ADDBBB5BF48305F258029D409BB251D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 062D87E0, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac33a191b0e004bc69e38011b5816b06669a84a702adcf2a4072be001ee653fa
Instruction ID: 338e00de921c21a2808732f04961d78d0dcf704ff3d90cc4bc20f7db4ad97865
Opcode Fuzzy Hash: ac33a191b0e004bc69e38011b5816b06669a84a702adcf2a4072be001ee653fa
Instruction Fuzzy Hash: 53314975B10209EFDB04DFB4D89499EBBB6FF89304F504529E902AB350DF39A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062DA320, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d120b4e953d5f0f1c984b36617b95b260b295938accdc8e3ea41836f3acd3cde
Instruction ID: 13628e5946138f9c24906dbc3d4a260060358dce25ee91e3972ec49ca3f82d13
Opcode Fuzzy Hash: d120b4e953d5f0f1c984b36617b95b260b295938accdc8e3ea41836f3acd3cde
Instruction Fuzzy Hash: D141C1B1D10758DFDB14CFAAC884ADEFBB1BF48314F24821AE819AB254D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 062DC7DC, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402d674bb3644e9303ef36345b1bfb1bdc202abf66c35eb330c4f445d02e5835
Instruction ID: c7cc8671d8f23238f724c47907c26bad77e3385401e58cc73ad5d4ec5a15d6db
Opcode Fuzzy Hash: 402d674bb3644e9303ef36345b1bfb1bdc202abf66c35eb330c4f445d02e5835
Instruction Fuzzy Hash: E7312171724601CFEB64EF28C88519A7B71EF91308F24886CE8968F341C736D85ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B3568, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a648f2b10e7ba82a644c228bc809a046044af4c845f787a1f9f9aed645edeb
Instruction ID: 840c2c298130073c31059ecf401c103de1220dab51cec71b47df881215cafcf7
Opcode Fuzzy Hash: 53a648f2b10e7ba82a644c228bc809a046044af4c845f787a1f9f9aed645edeb
Instruction Fuzzy Hash: 88419375E012189FDB18DFA9E884ADEBBB2FF88314F10812AE515AB350DB345941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 094B6B90, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f7eb198682327cf69707a1ba720a27a81373afda7e4738402650316fd9dff8
Instruction ID: 422127cb4dbf936c3abcc0b2ccf57fc4bd91d3890f0448d0d64623ca1571d879
Opcode Fuzzy Hash: f1f7eb198682327cf69707a1ba720a27a81373afda7e4738402650316fd9dff8
Instruction Fuzzy Hash: 932136353082506FE71857244CB4BBF2AA7EBC53A0F294066E60BDF3C0CE799C0243A6

Uniqueness

Uniqueness Score: -1.00%

Function 062D7288, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6f2858ebffc7a2296a8382f5c2cc12cf87e486715f5ae48500c6c9ad086539
Instruction ID: dc6bcdab7e53678e300996d58e1028d3c1eef9c4980d3571489c4596536daf8a
Opcode Fuzzy Hash: dc6f2858ebffc7a2296a8382f5c2cc12cf87e486715f5ae48500c6c9ad086539
Instruction Fuzzy Hash: C031EE72B247418FD760DF28D846A9ABBF2FB45214B040929E856CB701D778FC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 062DE05F, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8485998a0520a5ed9423be8d116bb482d4f735bade845ae9ecfe899e71ba3f
Instruction ID: eeb0b4f102967a187c99a68e294a9663ac21efa5883d5438813323326b5beb95
Opcode Fuzzy Hash: ce8485998a0520a5ed9423be8d116bb482d4f735bade845ae9ecfe899e71ba3f
Instruction Fuzzy Hash: 43312171724601CFDB69EF28CC8519A7B71FF91208B24886DD8968F341C736D95ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B6BA0, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa829adfa850ce5faaf5bd8eca2ff410a77aaec756353ad032223f386799670
Instruction ID: 7ad7aed0c6fa972556bb8fbcdc96e64b1a72928d02023753d3fe3793be0c9709
Opcode Fuzzy Hash: cfa829adfa850ce5faaf5bd8eca2ff410a77aaec756353ad032223f386799670
Instruction Fuzzy Hash: 9921F6303442146BE72866259CA5FBF266BEBC47A5F258025FA0ADF3C0CF75AC0243A5

Uniqueness

Uniqueness Score: -1.00%

Function 062DB520, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd79ae428a576763312d532591f0435d0a9bf35100c7c425633354984425e0d
Instruction ID: 8d97079fa86c1ce13643ecb6183965cae32b571884f6b2a02fa68a3a35debc5d
Opcode Fuzzy Hash: bcd79ae428a576763312d532591f0435d0a9bf35100c7c425633354984425e0d
Instruction Fuzzy Hash: BD2171B1F101165FCB91DBA9CD50ABFBBFAAFC4200F14852AD955D7251EB708A01C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 062D7222, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54265021c6feee13fd80722ddd44592d5a60f0bf4f405930d801e5dbeb928f10
Instruction ID: 988864090e7245a793afb698f4b6cc46038a6b274e71e7b58cee28eb4e5d71c9
Opcode Fuzzy Hash: 54265021c6feee13fd80722ddd44592d5a60f0bf4f405930d801e5dbeb928f10
Instruction Fuzzy Hash: F621AE72B207018FE7A0DF28D846B9AB3F2FB44214B140A29E856CBB01D778E9058B84

Uniqueness

Uniqueness Score: -1.00%

Function 094B43AD, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f019831490a56dc003845f7df19e10e8b04527e9586d23a0b502b778068098
Instruction ID: dd869d8549f8d32e19ef3366b2246dd3a601885d49f9ff4951d1d296bf9e2d8d
Opcode Fuzzy Hash: d3f019831490a56dc003845f7df19e10e8b04527e9586d23a0b502b778068098
Instruction Fuzzy Hash: 5231B474A0020ACBCB24DFA8C885AEEB7B1FB45344F24846AD919EB365E735D851CB61

Uniqueness

Uniqueness Score: -1.00%

Function 062D7298, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d1ad29b8982aa3cb85252b2c98f9daab0c7eb832e244e70bc2d88a43bc0adc
Instruction ID: 7856d6573f0c0b53df99e239bc487431f965e406ebfab9e8da8c5702cce0ad2a
Opcode Fuzzy Hash: 17d1ad29b8982aa3cb85252b2c98f9daab0c7eb832e244e70bc2d88a43bc0adc
Instruction Fuzzy Hash: 3321A571A20B059FE7B0DF38D446A9AB7F6FB45350F044E29E8A6CB640D778F9048B90

Uniqueness

Uniqueness Score: -1.00%

Function 094BBD50, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed667389ea3a3a07fd36ad7fee44af2a43958860e800724e7232c1a133863af7
Instruction ID: ff80af79420dfd5e0a3f439a5d5465aeb83f91c9c69948085fb1663c141c1aee
Opcode Fuzzy Hash: ed667389ea3a3a07fd36ad7fee44af2a43958860e800724e7232c1a133863af7
Instruction Fuzzy Hash: 5131B7B4E042099FDB44CFAAC581AAEFBF1FF88300F10846AD919E7714D7789A418F50

Uniqueness

Uniqueness Score: -1.00%

Function 062D79E0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0ff4da1d4bc69bf98a2b982248c2b6f79d6c6bbde4679202da3b07bc570544
Instruction ID: 657f5c0ebaa3c172b513961238c3d3647765fe52b48dc47e2bd706e0c073baf6
Opcode Fuzzy Hash: 7a0ff4da1d4bc69bf98a2b982248c2b6f79d6c6bbde4679202da3b07bc570544
Instruction Fuzzy Hash: B3319C30A10305DBC750DB68C844BEAB7F2FF41308F004AA9C4AA6B391D7B66D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013BD4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.668656733.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64027a9297ce3869687877cf9236a85396e98a010b880f06fc6d285c93bcfb9
Instruction ID: 01b04018909ebd82f6e2d73c18bdc40c08837cb24efa8e82a0c4c3d8e337d266
Opcode Fuzzy Hash: c64027a9297ce3869687877cf9236a85396e98a010b880f06fc6d285c93bcfb9
Instruction Fuzzy Hash: D7213A71504204DFDB05CF54D9C0BA6BF65FB8832CF24856ADA050BB06D336D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 062D6F80, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f5fdb78c54348034f6ca364efad0768516f11de1c949742a69275fdd7b1322
Instruction ID: 0d077ad0d43af514afe4f1da280e71dd0299cbd529e8384a049e4e91b832e9fa
Opcode Fuzzy Hash: b8f5fdb78c54348034f6ca364efad0768516f11de1c949742a69275fdd7b1322
Instruction Fuzzy Hash: 0511E172310A109FC740DE29D805A6977E9FF85618F1444AEF842CB352D776EC02CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 094BDA38, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7baa2e5a2b44cb15fe713441e3771d88db08f00444e052c4f6697ecbb927e236
Instruction ID: 8bb668930f49448c3779e30e2127feb8f1a08b91c73fdc42101c2bdead86ed3f
Opcode Fuzzy Hash: 7baa2e5a2b44cb15fe713441e3771d88db08f00444e052c4f6697ecbb927e236
Instruction Fuzzy Hash: D9212AB0E15209DFCB48CFA9C5416AEFBF5EF88300F2485AAD405EB264E7309B42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 062D7AD9, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1872b77a44f1c591ae37826e9ad7457a8eae83670b6f25b106db9d4f0b437abf
Instruction ID: 43712666ca202e66b956b31be6d49d06f2ca9f226dfd2e02e5de836152c5537f
Opcode Fuzzy Hash: 1872b77a44f1c591ae37826e9ad7457a8eae83670b6f25b106db9d4f0b437abf
Instruction Fuzzy Hash: 0531B130E1070A8FCB01DBA4D844AAEBBB5FF88304F01815AE515A7360EB30A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 062DEA84, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb3e9ef348d5d123fcf641843858e9edf1940e93426f2aff7714ebefa0e6a92
Instruction ID: 39fa86aef84cea5f17e86ff5c455658bfed10d7534dca74cdf668782f9c7a4de
Opcode Fuzzy Hash: ceb3e9ef348d5d123fcf641843858e9edf1940e93426f2aff7714ebefa0e6a92
Instruction Fuzzy Hash: FE21B6B1D1561ADACB013BA9E98A0BEFF75FF41251F410965D981B2184EB310468CB95

Uniqueness

Uniqueness Score: -1.00%

Function 062DAF40, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcdd6c2fcc95a86b9b81ed1b17b44e217384a758a60d28078d7d2242d9cbb54
Instruction ID: a7d75534b91b944ff308ac4c314d5e1cbe4b89a06b1743c88fd2bdd37a4c6146
Opcode Fuzzy Hash: 2fcdd6c2fcc95a86b9b81ed1b17b44e217384a758a60d28078d7d2242d9cbb54
Instruction Fuzzy Hash: 5C21C6B5E102198BDF44DBB8C940AEEB7F6AF89304F14413AD509F7240EB389A018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B416B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4452904ad7228113e4ad88fde414f9a96f98a48760320cb08e4151ce3edae24c
Instruction ID: 738665b97b50683ec9b999b209ec3256aad0f5de87dc009195ef03a35ba9a5c2
Opcode Fuzzy Hash: 4452904ad7228113e4ad88fde414f9a96f98a48760320cb08e4151ce3edae24c
Instruction Fuzzy Hash: 1C318FB4E10218DFDB64DFA8D885A9CBBB2FF49315F5080AAE519E7321DB309981CF10

Uniqueness

Uniqueness Score: -1.00%

Function 094BDA48, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ca5ed24aebd3be8d03cf608954d8b759b758d0230cfaa5ce5371d0698b4faa
Instruction ID: fe43614be720ff5bc9234d238ceb9724bffbe945c49012c49eda657c0fbd5a10
Opcode Fuzzy Hash: 65ca5ed24aebd3be8d03cf608954d8b759b758d0230cfaa5ce5371d0698b4faa
Instruction Fuzzy Hash: A9212BB0D15209DFCB04CFAAC5406AEFBF6AF89340F24D5EAD404AB254E7309B42DB65

Uniqueness

Uniqueness Score: -1.00%

Function 062DF799, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ea2be1ab4aed9389feb32776c873d256534a2171b9a12e50b7f9d1fca62246
Instruction ID: 7d0c09e66fcf2126a7725ce109ad8aa9dedf7cd97e753aca927039afea34a10a
Opcode Fuzzy Hash: f2ea2be1ab4aed9389feb32776c873d256534a2171b9a12e50b7f9d1fca62246
Instruction Fuzzy Hash: D42198B1D15615DFCB027BB9E94A0BEFF35FF41251F410965D985B2084EB310468CB95

Uniqueness

Uniqueness Score: -1.00%

Function 062DEA94, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a483f611081b7cdbb7e4de9ea5fb4f01b858433561fe8bef787a8b67eb93b3d3
Instruction ID: 4574a4ac4514115c99cfabe1ef7d2b66a8d0ca66f16aef5c782debb05fe28662
Opcode Fuzzy Hash: a483f611081b7cdbb7e4de9ea5fb4f01b858433561fe8bef787a8b67eb93b3d3
Instruction Fuzzy Hash: 9A1104327202125F9B94AF2AD98457EB7F6FF84221705442AE817CB7A0DF20DC01C799

Uniqueness

Uniqueness Score: -1.00%

Function 062DF6E0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c21d51c85df92755b4dec7edf338ff3d0d4b90b0f262cc18e7300f8022d250d
Instruction ID: e4628a2c580601d07a6f005fbe5b5f8b612cb43ac95cc0f8c5c0a41a21e6d915
Opcode Fuzzy Hash: 7c21d51c85df92755b4dec7edf338ff3d0d4b90b0f262cc18e7300f8022d250d
Instruction Fuzzy Hash: 5111DD35B00312AFD7649759E48066AB7E6EBC4224B14893ED95EDB700DB30EC468798

Uniqueness

Uniqueness Score: -1.00%

Function 062DB2A0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dccbaddfd15fe07050a66294f4be512b2a10a39ba61808ab8c3e26c143f24e0
Instruction ID: 4ff7fb3f211b861fae73f921b325c414f2f9963f99ba3a0b4482ab1c3b75ba19
Opcode Fuzzy Hash: 5dccbaddfd15fe07050a66294f4be512b2a10a39ba61808ab8c3e26c143f24e0
Instruction Fuzzy Hash: 65110035B102058FCB14EB78C4588AEB7FAEF842087418878D526DB750EF34EC098F91

Uniqueness

Uniqueness Score: -1.00%

Function 062DD970, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa1c292cd93f1f15a9b63809b0403f2ffe6fc22b7da64aa801d2e4c400fa329
Instruction ID: 6e17088d130ee1256222b1fd08de5d6dbd08094e120ffe7e9cbbc3cba1382f91
Opcode Fuzzy Hash: eaa1c292cd93f1f15a9b63809b0403f2ffe6fc22b7da64aa801d2e4c400fa329
Instruction Fuzzy Hash: 0F21CD36D24209CBDB10AFA8D4587EEBBB6EF88310F14C82AE80677344DF719944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B78D8, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977e5b7774ab9b75481bf632b55fcce97663e9c350e8414dd15e32eecc64fb57
Instruction ID: 23d1b321b124bf4e19564707eda4bd6d1a1b8f0db57f23e68d4affc6fe21dbe7
Opcode Fuzzy Hash: 977e5b7774ab9b75481bf632b55fcce97663e9c350e8414dd15e32eecc64fb57
Instruction Fuzzy Hash: 6F11BE30A00611DFD714DE24D0887AEBBA2EFC8360F15816AE80ECF761E7719842CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 094BBE70, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4a0d90d6db540372fe168fd75d77740b1a57b62c007beee5b2f6e00f507490
Instruction ID: e55c4567fe817798ed131de9f47f2b3707116d539d583509fb8b993c60f05309
Opcode Fuzzy Hash: cf4a0d90d6db540372fe168fd75d77740b1a57b62c007beee5b2f6e00f507490
Instruction Fuzzy Hash: D121C674E002199FCB48CFA9C5816AEFBF2FF88300F1085A6D518EB324E7309A418F91

Uniqueness

Uniqueness Score: -1.00%

Function 062DB29A, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc20a16e76232a8efc7e9fac839d80079fa43da0d80bf90fdfd4ae2cd3e16ddf
Instruction ID: 2a5bde23462afcbf67e3c8a3157346bc9310753ffd891553cd016e05816c1923
Opcode Fuzzy Hash: bc20a16e76232a8efc7e9fac839d80079fa43da0d80bf90fdfd4ae2cd3e16ddf
Instruction Fuzzy Hash: 0011D0367102058FCB50EB69C8548AEB7FAEF842087458479D516DB750EF30FD098B91

Uniqueness

Uniqueness Score: -1.00%

Function 013BD4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.668656733.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257b081933b2a8300d6a5ecfa3b496cf4cbf6894369f134b464c509bbc6e798c
Instruction ID: c21b855750760b5e646b7cb1be92b9f698641878c448b099c2a4c22c7df6bd3a
Opcode Fuzzy Hash: 257b081933b2a8300d6a5ecfa3b496cf4cbf6894369f134b464c509bbc6e798c
Instruction Fuzzy Hash: F011D376404280CFCF12CF54D9C4B56BF71FB84328F2486AAD9050B617C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 094B38A0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ed175e5098f4422f3cf607ccd8f95a1f15714d251594d2d1bf6ed27a181994
Instruction ID: bf76b38c193b632514c0faefc8e08dc1d03d523d5474b278cab40d44616260e5
Opcode Fuzzy Hash: e7ed175e5098f4422f3cf607ccd8f95a1f15714d251594d2d1bf6ed27a181994
Instruction Fuzzy Hash: A5111974D55209DBCB04DFA6E8849EEBBB1FB48344F105866E101B7310EB721E59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BD478, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b79b4f94b8412ce53f5fb97ab08f2da751ad4b3ad3400471ac150b36ab0ea4e
Instruction ID: 08bd6454f43271e60e81640debab0ec41365fc1c3ba30bb0fb45562a463d06b6
Opcode Fuzzy Hash: 4b79b4f94b8412ce53f5fb97ab08f2da751ad4b3ad3400471ac150b36ab0ea4e
Instruction Fuzzy Hash: 612117B0E00218CFDB08DFAAC8445EEBBB6FF88300F1081AAD409AB354DB345902CF51

Uniqueness

Uniqueness Score: -1.00%

Function 062D7128, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f665e881bedc9ce56de197f45989079f867ca533f886415fe2eae22a867bf8
Instruction ID: 6728dedb7c6436761b48f0100d74e240f45446f2984c647b1213f9e43c9b11dc
Opcode Fuzzy Hash: 52f665e881bedc9ce56de197f45989079f867ca533f886415fe2eae22a867bf8
Instruction Fuzzy Hash: F71108303003105BD740EB68D8153DBB6DAAB84718F50851DD189DF7C2CEFA6C4A47D1

Uniqueness

Uniqueness Score: -1.00%

Function 062DE1E1, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589667dc93ddf0896d6636aa75e00b1ca2f37329d5ffe46402a2c76df8cebf04
Instruction ID: cfebd618fa12cd9c32e5a15722cd74a2a3ea404bb47c3842559bded17224769c
Opcode Fuzzy Hash: 589667dc93ddf0896d6636aa75e00b1ca2f37329d5ffe46402a2c76df8cebf04
Instruction Fuzzy Hash: AC01263136022197E69066F9AC057EE76AADB80294F00043EDE1ACF381EE61DC0183D5

Uniqueness

Uniqueness Score: -1.00%

Function 062DF979, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07af2dc2db32db7faf0a2880d5faa721af92b21fd0b84fdc7d0afb75d57e0f53
Instruction ID: 0e5b6daa5b693c0b149ea7e3056bf0f91d828e50000dd59c27a73e19b7122c4a
Opcode Fuzzy Hash: 07af2dc2db32db7faf0a2880d5faa721af92b21fd0b84fdc7d0afb75d57e0f53
Instruction Fuzzy Hash: E601F232B006059FCBA4EB79DC4098EBBF9EF88220719007AD819CB350EA31EC02C755

Uniqueness

Uniqueness Score: -1.00%

Function 062D840A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91627f0963e99cf884eba30cbb20a15c27239a63351a9445c738d02f8ffb23ec
Instruction ID: 456cacd3c1b8423bb55db833b5071bfdbab3bc198be9306c70727adadd429bc4
Opcode Fuzzy Hash: 91627f0963e99cf884eba30cbb20a15c27239a63351a9445c738d02f8ffb23ec
Instruction Fuzzy Hash: 47118BB0E242058FEB64EFB4C4583AD7AB2AB88318F154439D802A7280DF3C4884CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 062DF893, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cda471bb06765f906ae2281c4e64d1f731a9ec0465ba79a2aabcadc29fd9fa
Instruction ID: 65666b562e46d8a54c84ac90cc9e33b7cc9b719cbb743e07862942f4c26207fd
Opcode Fuzzy Hash: 48cda471bb06765f906ae2281c4e64d1f731a9ec0465ba79a2aabcadc29fd9fa
Instruction Fuzzy Hash: 95015A31A0E384AFC7534B60985449CBF71AF8621031B80EBC895DF2A3D6358C26CB22

Uniqueness

Uniqueness Score: -1.00%

Function 062DC628, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7741a822e10101a18959ec8a04b899ce0c63a8c3585ad64975c24a842188520c
Instruction ID: 704610f8af703cd18a60ff05943e6350ad45e25afb47a198c1428e6377ecebef
Opcode Fuzzy Hash: 7741a822e10101a18959ec8a04b899ce0c63a8c3585ad64975c24a842188520c
Instruction Fuzzy Hash: 4C1133B19007098FCB60DF9AD884BDEFBF8EB49320F14841AD959A7700C374A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062DC67C, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30dcfd574de8a8fb3bbf987fb56f3a90e553bbd7f3accff6d268845090da6b
Instruction ID: 25b03cda3ec6ec5ff8b96aaed01c76b9289c10436e865c98ba1e2dfeb77801f4
Opcode Fuzzy Hash: 9b30dcfd574de8a8fb3bbf987fb56f3a90e553bbd7f3accff6d268845090da6b
Instruction Fuzzy Hash: 5D1133B19007098FCB60DF9AD884BDEFBF8EB49320F14841AD859A7700C374A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062D7138, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc58681df1b8ada0baedce4a1e5175f7b366a44cafbb0da91b6f8faa6598e86
Instruction ID: 4b20823469bfdf95e09db7dc82aa76e3beffca5404fdec9d73026071857ad0bf
Opcode Fuzzy Hash: ccc58681df1b8ada0baedce4a1e5175f7b366a44cafbb0da91b6f8faa6598e86
Instruction Fuzzy Hash: C9019E303003105BD754EB68D4157EBB6DAAB88B18F50891DD19A9F7C2CEFB6C4A47E1

Uniqueness

Uniqueness Score: -1.00%

Function 062DBF50, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5c3ba56fc8ef0988b8daba15becc87005411e66d8ced11677ef29906d33f51
Instruction ID: 01f6682a1d5552cc21316fce0cbc3605ac1f11bd27b0e1c6d45d638a4351313e
Opcode Fuzzy Hash: 3c5c3ba56fc8ef0988b8daba15becc87005411e66d8ced11677ef29906d33f51
Instruction Fuzzy Hash: 94F0A4B1B102155BCB96B6A8DC90ABEBAB6DB88611F040078ED19E73C1CF315E0647D9

Uniqueness

Uniqueness Score: -1.00%

Function 062DCD09, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e63806d1c9027f197282b4d34372135c9f5ab8971eb0746d2e5d6c135ca84e1
Instruction ID: 54905f1958b76cb197bcc901287ed9cb16bb446d081174ad21c2b7d9b2a2916e
Opcode Fuzzy Hash: 7e63806d1c9027f197282b4d34372135c9f5ab8971eb0746d2e5d6c135ca84e1
Instruction Fuzzy Hash: 511148B19007498FCB10DF99D884BDEFBF4EB49320F14841AD859A7750C334A948CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062DDE08, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31756242e7cad16db7833ab8303683f9ef450c5bac22bf314dec6c9134e00720
Instruction ID: 11a1f45f5ad00d15602b4c3639545dc9026ebf85b76a985adf95f031404e17cf
Opcode Fuzzy Hash: 31756242e7cad16db7833ab8303683f9ef450c5bac22bf314dec6c9134e00720
Instruction Fuzzy Hash: 7DF0F0323206116BD654561AEC46F7BB3AEEBC8A51F50403DE806CB392EA60EC0183E0

Uniqueness

Uniqueness Score: -1.00%

Function 013BD7E9, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.668656733.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e0c9b3da1a973a2e07badc2544d764fe8aca9b61f5750d109da6ea0a67d03c
Instruction ID: 24948d3eef5b60f0fe81a630ef84319f9c3f726b1b2c0d089842f76f61877c39
Opcode Fuzzy Hash: e1e0c9b3da1a973a2e07badc2544d764fe8aca9b61f5750d109da6ea0a67d03c
Instruction Fuzzy Hash: BB01F7314083449AE7205B56DCC47A6BF9CEF4527DF18845AEB0C9BE86D3759844CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 094BF138, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81409ecb5c511e4a4724e239cf3b073e4078888b27b4da4962a8037c8996dbb1
Instruction ID: b6b661a6e10f54010645e2fc537bb46eb64cf1549996d92dca6f8e7eac2e183d
Opcode Fuzzy Hash: 81409ecb5c511e4a4724e239cf3b073e4078888b27b4da4962a8037c8996dbb1
Instruction Fuzzy Hash: 4811F775D0025A9FCB04DFA9C945AEEBBF9BB48211F1481AAE554A7340D734AA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 062D6E6B, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39033c230297b9b9e9052dd7de3c193eb7c7cb7544bca00accf74977ddbc1928
Instruction ID: eea88c0ece3254bb793846073e38fcecb66da98164b2685ed42f605218e0cb3d
Opcode Fuzzy Hash: 39033c230297b9b9e9052dd7de3c193eb7c7cb7544bca00accf74977ddbc1928
Instruction Fuzzy Hash: AC012D203097901BE706A7348C1539A7ADE9FC6718F0581AFD186CF6D3CAEE4C0683D1

Uniqueness

Uniqueness Score: -1.00%

Function 094BA768, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c8dde0f1570a3ba8540be0c997e9241769e7df75af20db1c1df0d446b13351
Instruction ID: d14bc587a08699ba66c5a463bc16899862107ba19d9a4851222054b33430f729
Opcode Fuzzy Hash: 71c8dde0f1570a3ba8540be0c997e9241769e7df75af20db1c1df0d446b13351
Instruction Fuzzy Hash: 6701B171A19208EFC744DFA9D64569DFFF6EB88201F2484B79509D7304DA30CA858A51

Uniqueness

Uniqueness Score: -1.00%

Function 062DBF60, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9879943af7af8e19b77c0492e8638687057cc2441afce4280d32bf1355a2eba
Instruction ID: a7cbec4cdddb50ef641928808c4ac6fb3b3d6496ca1a008243429a6f134dcd92
Opcode Fuzzy Hash: c9879943af7af8e19b77c0492e8638687057cc2441afce4280d32bf1355a2eba
Instruction Fuzzy Hash: 27F036B1B101149B8F95B7A89C909BEBBBAABC8611B110069ED19A7384DF310D1147D9

Uniqueness

Uniqueness Score: -1.00%

Function 062D8920, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78993e26f291985db1492a1de9b3a31d42259bd357fd53e3eaa74c661337b5d
Instruction ID: fc605048a6529a661a1fdccce2b57224b716e8a62551cfeacfac055d682159b7
Opcode Fuzzy Hash: d78993e26f291985db1492a1de9b3a31d42259bd357fd53e3eaa74c661337b5d
Instruction Fuzzy Hash: A501A27180938A9FDB028F60DC10AC97F71EF86200F494297D440EF163D738A54ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 094BDB50, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24c07e69273d6c23cc3149d0f3210d990ee78fb28f57f8f227c77d5c4848e3a
Instruction ID: 40d7f9a9d2ba26de2e503277420d10910c23b3c0f540683c3f499d6c6ce137ce
Opcode Fuzzy Hash: b24c07e69273d6c23cc3149d0f3210d990ee78fb28f57f8f227c77d5c4848e3a
Instruction Fuzzy Hash: 3B012878E04208AFDB04DFA9C498A9DFFF1EF48204F05C0E6E548AB362DA349942CB41

Uniqueness

Uniqueness Score: -1.00%

Function 062DEABC, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41007a11b66664b71b8797c99168c2158ecbe01c6ba1675a30c49a36147a4251
Instruction ID: 870531b6e9a1be35dd8d36db598a840ef1f520d5b4a67a0d87f3624fc5920413
Opcode Fuzzy Hash: 41007a11b66664b71b8797c99168c2158ecbe01c6ba1675a30c49a36147a4251
Instruction Fuzzy Hash: F4F02432E11118FF87544F65E44449CBB72FF8036032280A8D8299B710CB319C12CF88

Uniqueness

Uniqueness Score: -1.00%

Function 062DEADC, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8add82e204ff258eac4eb78623e90d539e44f96f4bcdd2f8946bf4ae68f1b7f7
Instruction ID: f7d655c72def93c9b3cc25735d069dba0159382b7da7cb5a8e4ab813bf12396e
Opcode Fuzzy Hash: 8add82e204ff258eac4eb78623e90d539e44f96f4bcdd2f8946bf4ae68f1b7f7
Instruction Fuzzy Hash: 38F06231F112159BCBA4EB74D9406DDB7F5EF88610F004839D856AB740DA71AD46C792

Uniqueness

Uniqueness Score: -1.00%

Function 062DF90B, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a2292063ef3f5809d2487205f207a3af384b80fb2f220eb356ce7df39d5d54
Instruction ID: 725e0e674043db90fc2426bbb9b831e47f28b25819247d370aafa23ad5ed725e
Opcode Fuzzy Hash: 07a2292063ef3f5809d2487205f207a3af384b80fb2f220eb356ce7df39d5d54
Instruction Fuzzy Hash: D801D130A017458FCBA5EF74C9002DD7BF1AF49201F0104BAC892EF281EA345D0ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 062D79F0, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44abe72563fbec9aa9a162e6265c5b3fd341d0956953524495630e22899d3ad5
Instruction ID: 93533e53a1ed1c5c79305ec4b2fda2e4f3794ba569a14408dd13c4fad27c2dd8
Opcode Fuzzy Hash: 44abe72563fbec9aa9a162e6265c5b3fd341d0956953524495630e22899d3ad5
Instruction Fuzzy Hash: 01014C70215B408AD320EB78C4047D7B6EABF8170CF00495ED1EA1B6D2DBF6384887A6

Uniqueness

Uniqueness Score: -1.00%

Function 013BD7E8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.668656733.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7555568afc327dd775a6cc0ba05f8953d0eafb7f626599d69e5c95733209f7f9
Instruction ID: 0214ac68dada6717a77ec216ef1d4cca5d9933e5fdbfca21ee5c4909444fef6b
Opcode Fuzzy Hash: 7555568afc327dd775a6cc0ba05f8953d0eafb7f626599d69e5c95733209f7f9
Instruction Fuzzy Hash: 41F0FC714083449EEB118B06DCC4B62FF98EF81278F18C45AEE085B686C3759844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 062DB238, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831f2924f6d127384b9c7cbb3bbc5ebd629b4e770fc4db3c39f3f88fc90d5cf1
Instruction ID: 63d62816952f53a579f6425802efe575296fbfd97dce85322152b22f5cadce04
Opcode Fuzzy Hash: 831f2924f6d127384b9c7cbb3bbc5ebd629b4e770fc4db3c39f3f88fc90d5cf1
Instruction Fuzzy Hash: 43F04CB5D09208DFCB00CFB8E9959EDBBB1EF48205F218596D804E7754D7385E08CB41

Uniqueness

Uniqueness Score: -1.00%

Function 062D6E88, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836ad4a889f70d2436621b5484be76cb1aaebbe5ac9105b3497334aff333cfc0
Instruction ID: b7a9458ffca4605ffe440ebad15dabfe458d5c07ac23745ff36da60f563f2303
Opcode Fuzzy Hash: 836ad4a889f70d2436621b5484be76cb1aaebbe5ac9105b3497334aff333cfc0
Instruction Fuzzy Hash: 02F0A03430172457EB18BA6888153ABB0CF9BC8F18F00852FA1568F7C6CEFAAC4247D1

Uniqueness

Uniqueness Score: -1.00%

Function 094BDB60, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9155715aca3729809ebf384911be3668514b672d3eb361c30223cf73e9a186d3
Instruction ID: 1194f215ff207ef06792fb02e484519f85f29861f845fa0ee858eb0e8de40ba9
Opcode Fuzzy Hash: 9155715aca3729809ebf384911be3668514b672d3eb361c30223cf73e9a186d3
Instruction Fuzzy Hash: 6001B274E00208AFDB04DFA9D599A9DFFF1EF48204F05C0A5E9089B365DA30AA81CB40

Uniqueness

Uniqueness Score: -1.00%

Function 062D6F90, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99514c3459597f28f5317495a2c0f5f3737e7793579a29b866382cf430d612cd
Instruction ID: 24ad1cc47840770b040b00f6c4002b57b035fbd9c221e497a2968d5702be9696
Opcode Fuzzy Hash: 99514c3459597f28f5317495a2c0f5f3737e7793579a29b866382cf430d612cd
Instruction Fuzzy Hash: 5CF08235310A20CFC714EE6AD444E6AB3EAEFC5A61B16409AF441C7365CA74EC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094BCD14, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d83bd2e5f269b7349727d03ffb3bd8cbf51acc6e1c0d9f216c0fd51f37ef43
Instruction ID: 68b40d8542482a3bd4b259b295d754858ee3ee5f1479d979913828d267bad09d
Opcode Fuzzy Hash: 55d83bd2e5f269b7349727d03ffb3bd8cbf51acc6e1c0d9f216c0fd51f37ef43
Instruction Fuzzy Hash: E6113D789122288FCBA5CF69C980ADCBBF1BB4D311F1040D9E849A7324DB35AE91CF40

Uniqueness

Uniqueness Score: -1.00%

Function 062D7230, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b31ad93718be00868d94fa5cc23d5b956ef6275272dd85a040b68c74cbc6c4d
Instruction ID: 8876d3f095a5c37feb7953e6968cd0d49c81a9887e81c64a36c615e3a4d932bc
Opcode Fuzzy Hash: 2b31ad93718be00868d94fa5cc23d5b956ef6275272dd85a040b68c74cbc6c4d
Instruction Fuzzy Hash: D7F058B1A243458FDB58CF28D48398537E5FB04208720089EE82ACF701D777EC038B84

Uniqueness

Uniqueness Score: -1.00%

Function 062DC638, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a65e2c0246dbbf19f4ab590ae019ec85df68a090d22f51a4a69f7b5d132831c
Instruction ID: 257cab765c4cbe1077de607ed350f5876a711ed2bfec042cc9577dea142b9788
Opcode Fuzzy Hash: 1a65e2c0246dbbf19f4ab590ae019ec85df68a090d22f51a4a69f7b5d132831c
Instruction Fuzzy Hash: 64E022372193608FC706A738D8658CA3BE89F0611830408AAD016CF762EB29DC04C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 062D8465, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f427edd6ec26366fc621c189503cc121a38f0f5379b42bf6f2ccba2cca3dc0
Instruction ID: 9016bd15ea56b0ded99cf6591eb5e2838a3ed107cd6b3f9734416fbb4fbcb857
Opcode Fuzzy Hash: 98f427edd6ec26366fc621c189503cc121a38f0f5379b42bf6f2ccba2cca3dc0
Instruction Fuzzy Hash: 8BF05E70A642068BDB58AFB5C4557AD7AB2BF48308F148838D502A7680EF7C4845CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 062DEF60, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20fc8299a3c14350f66c47981abd0ed77b5758774b709b1d129b4df2d2b12a8
Instruction ID: b603d516fd95843adc1a558d136a6eb9614706581e7440a0a33d95a7633b4219
Opcode Fuzzy Hash: e20fc8299a3c14350f66c47981abd0ed77b5758774b709b1d129b4df2d2b12a8
Instruction Fuzzy Hash: 0AF0EC363205148FC785CF28F84465A3B61EFC0615B1984ADDC8D8F711C735EC06C781

Uniqueness

Uniqueness Score: -1.00%

Function 062D6F20, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b90b2bbe0b5d480ed065b4e990fbd0fc328a36f0f1c60de59af888a31aafd54
Instruction ID: 90c3f0aa09416dc78a3a155f3109a6af35cf0a9e761ff176a4fe4d225afc5e7c
Opcode Fuzzy Hash: 5b90b2bbe0b5d480ed065b4e990fbd0fc328a36f0f1c60de59af888a31aafd54
Instruction Fuzzy Hash: C6F0E571614714AFCB04DE28D80669537E8FB05218F20086DE846CF301E773ED0787C5

Uniqueness

Uniqueness Score: -1.00%

Function 062D6F30, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c2ca18153523fde5813423ee19854142bd3535a7ed68f04fb0e0a481e8c8d5
Instruction ID: 24a03b6ccb22d3179c027c322a2d7ff49c97c0a5aaadb56fbcdfa6f30d04fe0f
Opcode Fuzzy Hash: 26c2ca18153523fde5813423ee19854142bd3535a7ed68f04fb0e0a481e8c8d5
Instruction Fuzzy Hash: 80F01C71620B009F8B58DF2DD8015957BE5FF492187208AADE429CF751E7B3E8038BC4

Uniqueness

Uniqueness Score: -1.00%

Function 094B410F, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0bd06cb02979d8bd1a2034ab3c5a9ac915feeced99e1c6b8991aecd0434a24
Instruction ID: 5338aa319cd3cf2b99745399982006394c063f06224744e988246760e454a62f
Opcode Fuzzy Hash: ab0bd06cb02979d8bd1a2034ab3c5a9ac915feeced99e1c6b8991aecd0434a24
Instruction Fuzzy Hash: BEF0307490D3859FCB468FB888454CCBFB0EF07360B0401D7D4519B662E6394E47CB21

Uniqueness

Uniqueness Score: -1.00%

Function 062D70E8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c662d5deac50264c3774e5726ea7797ad72c6fa759ae1d4c978555645684a6
Instruction ID: 264054eb187b5ac38a17cbf1c2d21b0ac51f202ab40480e4e320f6a7b3fdca4d
Opcode Fuzzy Hash: 46c662d5deac50264c3774e5726ea7797ad72c6fa759ae1d4c978555645684a6
Instruction Fuzzy Hash: 39E07D327047144BC309961C98143DB76D9DFCD301F18407FD909EB3C1D9519C0083D1

Uniqueness

Uniqueness Score: -1.00%

Function 094BBF50, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb78300c76c4fc39ecdb42cf65bcd447a7f8dcfbf94ac9ed8ddc02b803d341b
Instruction ID: e776ae741edb0b0386ffc0dbbf758f59820804e25e55cffb718945c2ba3f6601
Opcode Fuzzy Hash: 0fb78300c76c4fc39ecdb42cf65bcd447a7f8dcfbf94ac9ed8ddc02b803d341b
Instruction Fuzzy Hash: A9F015B0D00308DFDB04EFA8D441AAEBBB4FB08305F1085AAE818A7300D7719A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 062DC650, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c9973df78e4a461dc3a41d7b2b7932a1c255a57f47396534801d7c587f92ee
Instruction ID: be77fc3a7c216abce3f4be8c5b286b85b4da774281efc44996840c793e72b96d
Opcode Fuzzy Hash: 80c9973df78e4a461dc3a41d7b2b7932a1c255a57f47396534801d7c587f92ee
Instruction Fuzzy Hash: 7FE012763602209F8B557738D45499A33DD9F4A219310086AA406CB721EF65DC01C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 062DE198, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecd9f5a9763a058a86a48e61b96072f6e287a08cec1cadead8a2255c081818b
Instruction ID: da997ab36580e79522ae2f4ebc3d7dfd014279daa0f6a2e2fc01232626b26a9b
Opcode Fuzzy Hash: 2ecd9f5a9763a058a86a48e61b96072f6e287a08cec1cadead8a2255c081818b
Instruction Fuzzy Hash: 8EE04F31750355C7E760ABB9D800BD673EA9F41154F004C3D9959CB740EB61EC0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 062DE1F0, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d26bc79c7f43e80736a725103892e2258a1211820bc115de8fc1a53bf459a9
Instruction ID: d36d99ab4cdb438b8662390940c2c1f12a503eb2ff8863a4d6ec13f4e7fd4aa5
Opcode Fuzzy Hash: c6d26bc79c7f43e80736a725103892e2258a1211820bc115de8fc1a53bf459a9
Instruction Fuzzy Hash: B5D05B3135422423555421ED6856B6F659E97C57E9B51006BEB06CB741DD528C0283D9

Uniqueness

Uniqueness Score: -1.00%

Function 094BC625, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd9e9d99b9a598565b08ae077cbc1672a506dd0c1423061c3a366baf8449309
Instruction ID: 339bd6ac3170f8e2a7abc98a976f8df94233edfdae655be03eea0104beaa711f
Opcode Fuzzy Hash: 1cd9e9d99b9a598565b08ae077cbc1672a506dd0c1423061c3a366baf8449309
Instruction Fuzzy Hash: FBF01CB4A01354CFC749CFA8D28099D7BB3BB49301F5040AAE0069B394CB35DE85CB00

Uniqueness

Uniqueness Score: -1.00%

Function 094BADF3, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7118dccba3e948e16f94f8691476020c734f8de56bcac2b36bd0f1c565ef75e0
Instruction ID: e577c56c60e4297369611b69446cda0782b9390468ac09f6958fae4836d257f2
Opcode Fuzzy Hash: 7118dccba3e948e16f94f8691476020c734f8de56bcac2b36bd0f1c565ef75e0
Instruction Fuzzy Hash: FBF0F870D012298BEB54CF99C890BC9BBF2FF98300F0085A6D108AB354E7304A81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 094B4048, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65324b25d19d475e19cca36dcf3abcda9c6f205831de4c6512d287e359ba19e3
Instruction ID: 56c1472df7d963a4103ce17fc925c395cd0619a5c19734ae651256f484ca1328
Opcode Fuzzy Hash: 65324b25d19d475e19cca36dcf3abcda9c6f205831de4c6512d287e359ba19e3
Instruction Fuzzy Hash: CDE0863091530CEFC704FFA8E8459AEBF35FB46349F1091A9E84427350CB305A54DB55

Uniqueness

Uniqueness Score: -1.00%

Function 062DB248, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebea531b286a3882ed2484cb52a53b3878dfff91793e03aae60e310fbc563b7c
Instruction ID: b3c7af734718428cdf1d4117ab21aaa3b3952add28c2cf8ca6bed81d287b9a72
Opcode Fuzzy Hash: ebea531b286a3882ed2484cb52a53b3878dfff91793e03aae60e310fbc563b7c
Instruction Fuzzy Hash: 48E04F74A00208EF8B00EFB8F9458ACB7BAEB452147108155E80893700EB356E08DF51

Uniqueness

Uniqueness Score: -1.00%

Function 094BB195, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5321ebcad06d6dc0b1959da3f6d8348d4150a80aca691ee2e0545e8013500323
Instruction ID: bca79a3ba11120b5f6079eecc57850d66ae0211db57200ddcb1b2ffa4ad06504
Opcode Fuzzy Hash: 5321ebcad06d6dc0b1959da3f6d8348d4150a80aca691ee2e0545e8013500323
Instruction Fuzzy Hash: 30E0C930A092299FEF14DBA4D890ADDB7B2EF89204F1194AAD105AB264D7305A459F62

Uniqueness

Uniqueness Score: -1.00%

Function 062D70F8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2406acdf634989f9210cdcd19ae34e4a5f0a9cd588a296f974449f97adec9f8a
Instruction ID: 42fe910390add1c4a79750fc43d84fd29ea26f77b1126040c55614cd9627ff49
Opcode Fuzzy Hash: 2406acdf634989f9210cdcd19ae34e4a5f0a9cd588a296f974449f97adec9f8a
Instruction Fuzzy Hash: 5ED05E313047145BC70D6A5C94207DBB6CE9FCD751F05806BE5099B390D9A19C0042D5

Uniqueness

Uniqueness Score: -1.00%

Function 062DCFF1, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236fd581b482b865680598c96fcefdf1c47861e62a0a7974387278ec88b7cb38
Instruction ID: a5c70ea8f1d85ab1bda02b6d204707ab7a65622b04078678d96b78536bacb1b2
Opcode Fuzzy Hash: 236fd581b482b865680598c96fcefdf1c47861e62a0a7974387278ec88b7cb38
Instruction Fuzzy Hash: 68D012623A547617D7852194ED433AD35458B84D14F48006A854DCB3C2CE55985103C9

Uniqueness

Uniqueness Score: -1.00%

Function 094B4156, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022e6594359a1ea7adfc8e896ba07d84f09e0674c8535a18b5899245341bfc31
Instruction ID: 901f014d56ad95753a4b02c7ccf92845320f290926fa8de6b050cebd48d50e00
Opcode Fuzzy Hash: 022e6594359a1ea7adfc8e896ba07d84f09e0674c8535a18b5899245341bfc31
Instruction Fuzzy Hash: 9EE0E278908358CFCB45CFA0D4954DDBFF1AA16340B005056D44AAB351DA355D12CF20

Uniqueness

Uniqueness Score: -1.00%

Function 062D84D8, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35941673c13a30e5ea43ccd2e053b1a43b2c36633b3096f96512b46a58a61401
Instruction ID: d222675565c9ec03183b12b49abe01de451f9389f3b0d00b454c8dd46978b35c
Opcode Fuzzy Hash: 35941673c13a30e5ea43ccd2e053b1a43b2c36633b3096f96512b46a58a61401
Instruction Fuzzy Hash: 06E0E2B4A5010ACFDB40CFA8D099AADBFB0EF08304F208019E502A7260CB749804CF50

Uniqueness

Uniqueness Score: -1.00%

Function 062D7AB0, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a68ef9a34cb136233b8af762a402874c70fd267785dc6bd2821cc33d131830b
Instruction ID: 9f852b1ae8d7354d14c380e07efd25f1c1dc4feb179df2892b4d3f69a1f19c41
Opcode Fuzzy Hash: 7a68ef9a34cb136233b8af762a402874c70fd267785dc6bd2821cc33d131830b
Instruction Fuzzy Hash: 60D01276418A108AD755AF68E800396B6F4DF44210F14886E8494DB341C638D9464740

Uniqueness

Uniqueness Score: -1.00%

Function 062DD000, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a71ae42cf52e237bf57bd944cc4e26173ce0e2262c76cee4d0f091fca092fe9
Instruction ID: 2fd34b08a9fb911606943eaed36f3682141ace553e7a067f16b8eb1f1292da87
Opcode Fuzzy Hash: 5a71ae42cf52e237bf57bd944cc4e26173ce0e2262c76cee4d0f091fca092fe9
Instruction Fuzzy Hash: C7B09B2136453813C944319D64115AD71CD47D5D64F50016BD50DC77415DC55C4102DD

Uniqueness

Uniqueness Score: -1.00%

Function 062D7F38, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae775c224c979052b954cd83ff9e337ced5659d24bdb202f0556ca97d8153bd
Instruction ID: 96a9fb040ae838dccf8fa86c236a4223c0b5bc8562e4e4ea4636f5cdbe4e675a
Opcode Fuzzy Hash: 5ae775c224c979052b954cd83ff9e337ced5659d24bdb202f0556ca97d8153bd
Instruction Fuzzy Hash: DED05EB0619385CACF20DB2CF94D7CA7BA8DB01346F041429DC8086950C67A0918DB42

Uniqueness

Uniqueness Score: -1.00%

Function 094B81E8, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e80166d54343c2b0bb3f04a325efb905373a2df20d1aa4d64e35a7fd81b9f70
Instruction ID: f3f83043f802ea01e767c102e36028b3699015002c2265a4e7db3f9f4f6db8dd
Opcode Fuzzy Hash: 7e80166d54343c2b0bb3f04a325efb905373a2df20d1aa4d64e35a7fd81b9f70
Instruction Fuzzy Hash: DDC012715B034546C644FB75F8C449A377EEFC05483409860D4050A914FF795C0846C6

Uniqueness

Uniqueness Score: -1.00%

Function 062DD764, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.676618164.00000000062D0000.00000040.00000001.sdmp, Offset: 062D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6a31b78e33268cb145c46e9af245eb70df0cfbf5942f043e406086df2a2e48
Instruction ID: 3f541114ba914870319cd51709174f10ca2c9433d28b47adb13795c374889fcf
Opcode Fuzzy Hash: 6c6a31b78e33268cb145c46e9af245eb70df0cfbf5942f043e406086df2a2e48
Instruction Fuzzy Hash: 21C08C312211008BC3C4AB28CC800E97232FF8020C3989CA998094EB21DB7BCC47C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 094BCDBE, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9211a1d2960c5c473e81887edc66d5ae8e7399d91dc9c09827f9295205ddfd92
Instruction ID: ab627fd2015bf847bdb7d93a8aa808463db43b62b49068a754881c080afb484b
Opcode Fuzzy Hash: 9211a1d2960c5c473e81887edc66d5ae8e7399d91dc9c09827f9295205ddfd92
Instruction Fuzzy Hash: 1FD06774901368CFCB15CF54C9849EDBBB1EB0A301F104095E845A7310C7329E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 094B42D6, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692f0b2e738eee6bb022c1c9778b67cf95ad61dedaba0179e121e183740e407b
Instruction ID: d145cf2d28cca10a960cb567fd251fcc25650964b403826a1b333898fe3434b2
Opcode Fuzzy Hash: 692f0b2e738eee6bb022c1c9778b67cf95ad61dedaba0179e121e183740e407b
Instruction Fuzzy Hash: 3EA0022195E4149ACA089BA0C9654FDA239BB59788F1010598046250728A2A1801C520

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 094BF9C8, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

*-c, xrefs: 094BFA17

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID: *-c
API String ID: 0-3927222349
Opcode ID: 724a7f24b528b65c1e148f619de3488fcefe223e4859733b565ddccdf201fbd9
Instruction ID: ad5349547cf0013a36d9ad0cd3d5ad702ec20f1419e134a323a10c2c2e2be7fb
Opcode Fuzzy Hash: 724a7f24b528b65c1e148f619de3488fcefe223e4859733b565ddccdf201fbd9
Instruction Fuzzy Hash: 53410C70E05209DBCB08DFA9C9415EEFBF2BB88350F14D166C508B7314D7309A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094BF9B8, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

*-c, xrefs: 094BFA17

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID: *-c
API String ID: 0-3927222349
Opcode ID: cea4d2a84d8ce9dc8fc593e060fc0fce800a764b928b489bc87d675eed7424ba
Instruction ID: adfd4296cb2965258ef34603791d72f9168555a9ec259ed270fb7affa8ee4b94
Opcode Fuzzy Hash: cea4d2a84d8ce9dc8fc593e060fc0fce800a764b928b489bc87d675eed7424ba
Instruction Fuzzy Hash: 5C411D70E0520ADBDB08CFA5C9415DEFBF2FF89314F14D5AAC505A7214D7349A46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 094BA8DA, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

2=Sr, xrefs: 094BA8DA

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID: 2=Sr
API String ID: 0-2018019186
Opcode ID: 7db853701a009a4d88837a65806ead2ff25bfb49b45e82999d36ab7a2b1478bc
Instruction ID: 11c723ca8b441e361012dc817f6a02b541863ba2c08f5a5bb5a76f7814eb2c3a
Opcode Fuzzy Hash: 7db853701a009a4d88837a65806ead2ff25bfb49b45e82999d36ab7a2b1478bc
Instruction Fuzzy Hash: 33414670E14219CFCB10CFA9C980A9EF7F6BF89355F15D6A6D409AB215C3309982CF60

Uniqueness

Uniqueness Score: -1.00%

Function 030D9990, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2301c77a7d0dd42c678447ae49c5e5d6b065959824f694c1d3c728807f7d54c7
Instruction ID: 15eda6e4f341352e9c772847480fcfd9add8936243b45e5f163c68fff15942c7
Opcode Fuzzy Hash: 2301c77a7d0dd42c678447ae49c5e5d6b065959824f694c1d3c728807f7d54c7
Instruction Fuzzy Hash: A3A15D36E117198FCF15DFA9C8445DEBBF2FF89300B15856AE805BB221EB71A905CB40

Uniqueness

Uniqueness Score: -1.00%

Function 030DC508, Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669182461.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fb71b340324334b9f6a261376730bc9ccbf03a8345dc2d838bbe7b5e6ca73c
Instruction ID: c4210bbd79fcc439fffddffb23795722b534b645f0c4b1ed245ce177f2fc8005
Opcode Fuzzy Hash: 70fb71b340324334b9f6a261376730bc9ccbf03a8345dc2d838bbe7b5e6ca73c
Instruction Fuzzy Hash: C9C1E9F18217458AF710DF65E98AB897FB1BB45328F608309E1617B6D0EFB81446EF84

Uniqueness

Uniqueness Score: -1.00%

Function 094BA8F5, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.680365494.00000000094B0000.00000040.00000001.sdmp, Offset: 094B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd4145f8197cdaff131bb03a6007e9ebfa637220d08f481a1b70a1ef6bf17aa
Instruction ID: f61ab9b88598a0385386ea47b030f4741c6b7fed82c13bc4ef4280093d7209ac
Opcode Fuzzy Hash: 3bd4145f8197cdaff131bb03a6007e9ebfa637220d08f481a1b70a1ef6bf17aa
Instruction Fuzzy Hash: 10513870A14219CFCB10CF65C984A8EFBF6FF89255F19D5A6D508AB212D330D982CF61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: invoice.exe PID: 6488 Parent PID: 6980 invoice.exeCOMMON

Executed Functions

Function 0606C6F8, Relevance: 7.0, APIs: 4, Instructions: 963libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 28fcac86c20f49af51d4f029d6dbe188ccd6dc78e9667ecb209b0855f8fc4cf4
Instruction ID: c7f1e9c30ca966b77902dc10de1f22b8535b4553838963936af5a54f87b4de7f
Opcode Fuzzy Hash: 28fcac86c20f49af51d4f029d6dbe188ccd6dc78e9667ecb209b0855f8fc4cf4
Instruction Fuzzy Hash: 7AA21C74A41228CFCB65EF30D85869DBBB6BF48305F2081EAD949A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01323EAA, Relevance: 1.8, APIs: 1, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5298e0fa19fee10a11de4617f264a2394b06ec28fba73dd35895c6fd36d2f2
Instruction ID: 456756d7f5c73b6eba6a3aaf4f14908a1cab80c098222830c9a67532570f021f
Opcode Fuzzy Hash: 9a5298e0fa19fee10a11de4617f264a2394b06ec28fba73dd35895c6fd36d2f2
Instruction Fuzzy Hash: F6C17E70A007158FDB14EF79D4946AEBBF1FF88208B108A2ED449DB751EB35E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0606516C, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0606B633

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: da4e56c868aad5dc9017a3f3108b52dedb89d8af8aa63d4ba51422242fdfe842
Instruction ID: 64005a869db4ec2d17fbd0105d062b7308338cf5406298ede737bdad7151a0f7
Opcode Fuzzy Hash: da4e56c868aad5dc9017a3f3108b52dedb89d8af8aa63d4ba51422242fdfe842
Instruction Fuzzy Hash: D551E1B0D002188FDB54DFAAC995BDEBBF1BF48314F148129E815AB351DB789844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0606C719, Relevance: 6.6, APIs: 4, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 04dceecc3f9f02ad706fc57db7a95589ab59e4e3dfd1fe4719b14f953624c323
Instruction ID: c66835563fd520947a8a388835ecfaa9a9870d94dc9ad8367997e894deb73b91
Opcode Fuzzy Hash: 04dceecc3f9f02ad706fc57db7a95589ab59e4e3dfd1fe4719b14f953624c323
Instruction Fuzzy Hash: 15620A74A45228CFCB659F30D89869CBBB6BF48305F2081EED649A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C75E, Relevance: 6.6, APIs: 4, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 600223848552606296d71879bb8c61e7e001e1146fa82c56bc7acffb49dcb360
Instruction ID: a4fcc3dcc3a1dde0a9285060f4542e9dba817e0767565c585a6786b9ff26fe31
Opcode Fuzzy Hash: 600223848552606296d71879bb8c61e7e001e1146fa82c56bc7acffb49dcb360
Instruction Fuzzy Hash: C0620A74A45228CFCB659F30D88869CBBB6BF48305F2081EED649A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C7A3, Relevance: 6.6, APIs: 4, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a306d0c64511d1ee1d14e63f2373e21c60d7257e9976536d06cfb203db4a5e8c
Instruction ID: bed6d2636ffabc67eae986e7876ec0ecf6c7cc9b1093af0339a6d87a2126e64e
Opcode Fuzzy Hash: a306d0c64511d1ee1d14e63f2373e21c60d7257e9976536d06cfb203db4a5e8c
Instruction Fuzzy Hash: 6C520A74A45228CFCB659F30D89869CBBB6BF48305F2081EED649A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C7E8, Relevance: 6.6, APIs: 4, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1543b37a044793ff56356fd17c17b11d69141d2e39478b7b5a8af47a003de788
Instruction ID: a329f47a75e785c0a1b03de2fb6093130d5e961d3ad1c34b4a81b943d3058e39
Opcode Fuzzy Hash: 1543b37a044793ff56356fd17c17b11d69141d2e39478b7b5a8af47a003de788
Instruction Fuzzy Hash: A3520A74A45228CFCB659F30D89869CBBB6BF48305F2081EED649A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C82D, Relevance: 6.6, APIs: 4, Instructions: 609libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1e466795939550e4ba259430e0cf2bd529c0c954c5fd87fff8acd4cf8163bfdf
Instruction ID: 9e428d7cfd671dfa31cfb9e6541956f12405c0ebfc5677f8352e00affe633336
Opcode Fuzzy Hash: 1e466795939550e4ba259430e0cf2bd529c0c954c5fd87fff8acd4cf8163bfdf
Instruction Fuzzy Hash: 16520974A45228CFCB659F30D89869CBBB6BF48305F2081EAD649A7344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C872, Relevance: 6.6, APIs: 4, Instructions: 600libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f6aab62064504aedb6688b31e22cc3fa467b9c0f309c7c8218b9acc67b0bfb83
Instruction ID: b9512871a40511747215a1009b20a5480fb0afc154f3b0056c869e277989c309
Opcode Fuzzy Hash: f6aab62064504aedb6688b31e22cc3fa467b9c0f309c7c8218b9acc67b0bfb83
Instruction Fuzzy Hash: 54520A74A45228CFCB659F70D89869CBBB6BF48305F2081EED649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C8AE, Relevance: 6.6, APIs: 4, Instructions: 595libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 96fab3432edbf5ed7d31e7c3dc939c3c553aefa49b15026ef4219364e6b0d303
Instruction ID: c9d53897bf4596f70486d971411b7c0967ff624d1897e4cbf5abab0871ed0bb3
Opcode Fuzzy Hash: 96fab3432edbf5ed7d31e7c3dc939c3c553aefa49b15026ef4219364e6b0d303
Instruction Fuzzy Hash: DD520A74A45228CFCB65DF30D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C8F3, Relevance: 6.6, APIs: 4, Instructions: 588libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 76ad7cc09104d59ced37c35a8aece3fe34ec7d8e0db026385a9020cae8a59ff7
Instruction ID: c3ae75648c645be35457c1555622e270a4278445e1c1d00e2d03f5b680e5fc71
Opcode Fuzzy Hash: 76ad7cc09104d59ced37c35a8aece3fe34ec7d8e0db026385a9020cae8a59ff7
Instruction Fuzzy Hash: A0520A74A45228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C938, Relevance: 6.6, APIs: 4, Instructions: 581libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 07ee4e4426f41e64d4bbb446679350af8b650914421af24c6b3c8f98fd234a3f
Instruction ID: 6fb5b895400f87a8fbf7bed43c55f97ccdcb490cb1d6b51a08de5b2b74575da1
Opcode Fuzzy Hash: 07ee4e4426f41e64d4bbb446679350af8b650914421af24c6b3c8f98fd234a3f
Instruction Fuzzy Hash: F0520A74A45228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C97D, Relevance: 6.6, APIs: 4, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d704be071c89e54191ae8eafe8eb3f30033deaf2ca15e52ce1c0a4c134933b4f
Instruction ID: 322d05c90a5ea37f2e0f8946ad659134471d055c84025437c2e8f7a941d79a1a
Opcode Fuzzy Hash: d704be071c89e54191ae8eafe8eb3f30033deaf2ca15e52ce1c0a4c134933b4f
Instruction Fuzzy Hash: AE421A74A45228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606C9C2, Relevance: 6.6, APIs: 4, Instructions: 567libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ac331ce89fc1b50fc0d529be62fac6954a4aeee66737627de2efa24508cf9e3b
Instruction ID: fec4d90081bc9c5903118d8719d3f766f6748bfe4ed749157c39cfcfb6281513
Opcode Fuzzy Hash: ac331ce89fc1b50fc0d529be62fac6954a4aeee66737627de2efa24508cf9e3b
Instruction Fuzzy Hash: 22421A74A41228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606CA07, Relevance: 6.6, APIs: 4, Instructions: 558libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f9eea481220bc7f84bff5226ea2c29a8bceee61746cdd88a16354af243530e30
Instruction ID: f55c8eb018aed4ccb17f67a0c48a99d99c779e423b0d902919c58a1ad43be8d1
Opcode Fuzzy Hash: f9eea481220bc7f84bff5226ea2c29a8bceee61746cdd88a16354af243530e30
Instruction Fuzzy Hash: 3C421B74A45228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606CA43, Relevance: 6.6, APIs: 4, Instructions: 553libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 876882ccf871312d934dae33d1b252413a1e44ec41f510b0f108fb11e473c3b0
Instruction ID: 4f34b96aed47c32ab893b781866d90650014815d8081a7e040b359611f967586
Opcode Fuzzy Hash: 876882ccf871312d934dae33d1b252413a1e44ec41f510b0f108fb11e473c3b0
Instruction Fuzzy Hash: 4A421B74A41228CFCB65DF70D89869CBBB6BF48305F2081EAD649A3344DB399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606CA88, Relevance: 6.5, APIs: 4, Instructions: 544libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e38b3b40ba17f0727bcc43f226fd448b2ae79e8560a2fbe1b11ad626f35b4007
Instruction ID: ace16f163acc1c7f7ef5743337c87abb7dfc63492f6c63bed0b80bcdd95de3fa
Opcode Fuzzy Hash: e38b3b40ba17f0727bcc43f226fd448b2ae79e8560a2fbe1b11ad626f35b4007
Instruction Fuzzy Hash: 0D421B74A41228CFCB659F70D89869DBBB6BF48305F2081EAD649A3344DF399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0606CAC4, Relevance: 6.5, APIs: 4, Instructions: 539libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5fdf9c1a774cc29a38f3ade17d2691307828e5c812900a654bf8b1903721e3b6
Instruction ID: 276439c1ebc1cae9e6bf8f6655a09c7e481246a52ab6de6cb0ca47d82eca25af
Opcode Fuzzy Hash: 5fdf9c1a774cc29a38f3ade17d2691307828e5c812900a654bf8b1903721e3b6
Instruction Fuzzy Hash: 81421A74A41228CFCB659F70D89869CBBB6BF48305F2081EAD649A3344DF399E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0606CB09, Relevance: 6.5, APIs: 4, Instructions: 532libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: aeef9c3e9fcc95398528fc9b2b1ab77d5bc54f37c33d3f55f1661aaf47bee8cc
Instruction ID: e632b10021745d2a19a53fa59b98f5d9df8ff2299beccbdff96db485dec9ec80
Opcode Fuzzy Hash: aeef9c3e9fcc95398528fc9b2b1ab77d5bc54f37c33d3f55f1661aaf47bee8cc
Instruction Fuzzy Hash: A3421B74A41228CFCB659F70D89869DBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CB4E, Relevance: 6.5, APIs: 4, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606CB72
LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 46f1a857a60f1aa88f8ad9d8caccf09bc604d550b947d3c5a758d53f307e11b9
Instruction ID: cc053d252c4d827c06572d3f5d30f53a27d0b4e728bf8064f5e619b05d361d61
Opcode Fuzzy Hash: 46f1a857a60f1aa88f8ad9d8caccf09bc604d550b947d3c5a758d53f307e11b9
Instruction Fuzzy Hash: 9D321B74A41228CFCB659F70D89869CBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01326B7F, Relevance: 6.1, APIs: 4, Instructions: 137threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01326C10
GetCurrentThread.KERNEL32 ref: 01326C4D
GetCurrentProcess.KERNEL32 ref: 01326C8A
GetCurrentThreadId.KERNEL32 ref: 01326CE3

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 211638ca77d275f94fab7de5abffe52ab2798ad8d724463aa443532dd3f9a000
Instruction ID: 5afb7ef9f77a83643951edd80251086ec4e23e0a578d6eae595783d4114b167d
Opcode Fuzzy Hash: 211638ca77d275f94fab7de5abffe52ab2798ad8d724463aa443532dd3f9a000
Instruction Fuzzy Hash: AC5165B09003488FDB14DFAAD949BDEBFF0EF48318F24846AE459A7790D7745948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01326BB0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01326C10
GetCurrentThread.KERNEL32 ref: 01326C4D
GetCurrentProcess.KERNEL32 ref: 01326C8A
GetCurrentThreadId.KERNEL32 ref: 01326CE3

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e3a6b1c7479c445d3fab03c34c14c7179f94ddcbd279b9962f70c34ddd96c8cb
Instruction ID: d11e10b78e2d3a119b2d19c4520bd8252c04236a01a6d6939980c51fcabb9636
Opcode Fuzzy Hash: e3a6b1c7479c445d3fab03c34c14c7179f94ddcbd279b9962f70c34ddd96c8cb
Instruction Fuzzy Hash: 545152B09007588FDB14DFAAD649BDEBBF0EF48318F20845AE419A7750D7745948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0606CB93, Relevance: 5.0, APIs: 3, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 3b7a8f308aeee07d6bebff097173085d8f3ef70523f24589a1f07775b53e14b4
Instruction ID: bdd8c9f10311792850a159793a60852c8021f4393f143743fb0e75e2d71f366b
Opcode Fuzzy Hash: 3b7a8f308aeee07d6bebff097173085d8f3ef70523f24589a1f07775b53e14b4
Instruction Fuzzy Hash: 7A320B74A45228CFCB659F70D89869CBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CBD8, Relevance: 5.0, APIs: 3, Instructions: 511libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: defe72c58143a0d611e87aa313596e48aa01079fe476b67d7df200520b44b3e1
Instruction ID: a897bcacc41a7a0bc56d4c8eed5458fccdc085b81544f43a213900c9f7ae22bc
Opcode Fuzzy Hash: defe72c58143a0d611e87aa313596e48aa01079fe476b67d7df200520b44b3e1
Instruction Fuzzy Hash: 2A320B74A41228CFCB659F70D89869DBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CC1D, Relevance: 5.0, APIs: 3, Instructions: 504libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f555c0690d43ddde8d696d66167f9e8a9041cd0e2b3e646a812b93f12bf31ac4
Instruction ID: 912e5cc7115907e4ab1c9851375f91b2a2306c1e338f24b041714a50f9244258
Opcode Fuzzy Hash: f555c0690d43ddde8d696d66167f9e8a9041cd0e2b3e646a812b93f12bf31ac4
Instruction Fuzzy Hash: 1B320B74A41228CFCB649F70D89869DBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CC62, Relevance: 5.0, APIs: 3, Instructions: 497libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b3de75a1020d47bf67bcfc9ca4f1472dac1af36586146b114d804c9ee91bb835
Instruction ID: 6ae4326c0fc7c714325ca2ff6b8cf01f6f5d51a464786656a2f0edb85348e6bc
Opcode Fuzzy Hash: b3de75a1020d47bf67bcfc9ca4f1472dac1af36586146b114d804c9ee91bb835
Instruction Fuzzy Hash: 99320B74A41228CFCB659F70D89869DBBB6BF48305F2081EAD54AA3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CCBD, Relevance: 5.0, APIs: 3, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cff6d60b9fd8d95ba91134a58df59460a2e9209842613cb884a6864c0118c668
Instruction ID: 0de5615052c9d076ac58fe5e2d61adf16afbccf9cbdebcd5b2fdfb38123313fc
Opcode Fuzzy Hash: cff6d60b9fd8d95ba91134a58df59460a2e9209842613cb884a6864c0118c668
Instruction Fuzzy Hash: 7B320B74A41228CFCB649F70D89869DBBB6BF48305F2081EAD649A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CD02, Relevance: 5.0, APIs: 3, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 07c8fde95b654d0027171817c1ccd687f13c8123af6778fec5bba8e2e7a544cd
Instruction ID: 785d3c97574753d48a40196486b5e422425379340676f787342887c60f2c7c4e
Opcode Fuzzy Hash: 07c8fde95b654d0027171817c1ccd687f13c8123af6778fec5bba8e2e7a544cd
Instruction Fuzzy Hash: 90220B74A41228CFCB649F70D89869DBBB6BF48305F2085EAD549A3344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CD47, Relevance: 5.0, APIs: 3, Instructions: 470libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5d4be5b0b666e33138845aeb88ef54dace8424a5ea83f1c1863eccd986c63b51
Instruction ID: af220750322acb34406db5fbd5602d55a13487ab7b04bbbe79235f6e6001b538
Opcode Fuzzy Hash: 5d4be5b0b666e33138845aeb88ef54dace8424a5ea83f1c1863eccd986c63b51
Instruction Fuzzy Hash: 30220B74A41228CFCB64AF70D89869DBBB6BF48305F1081EAD64A93344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CD83, Relevance: 5.0, APIs: 3, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 194046c0b609085ea1ccaa4fd95b23fe708f49e3aa4a960ef6193a5d88e04f08
Instruction ID: 16fb3ac0af90b4f15bb4d58218c34b17bb49b9070a69d03a0fc2ce3a98dd3898
Opcode Fuzzy Hash: 194046c0b609085ea1ccaa4fd95b23fe708f49e3aa4a960ef6193a5d88e04f08
Instruction Fuzzy Hash: 2A220B74A41228CFCB649F70D89869DBBB6BF48305F1085EADA4A93344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CDC8, Relevance: 5.0, APIs: 3, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 30ceb5073b95741ae4fb39bb9adfba0163bd9d3592e5ffdbea91ba39fbba6a05
Instruction ID: d89c04a45eec55355d48352b0ad16796a4bac0a14f6619ea0e365b7a59f29718
Opcode Fuzzy Hash: 30ceb5073b95741ae4fb39bb9adfba0163bd9d3592e5ffdbea91ba39fbba6a05
Instruction Fuzzy Hash: B4221B74A41228CFCB649F70D89869DBBB6BF48305F1081EAD94993344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CE0D, Relevance: 5.0, APIs: 3, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e25d1a989bb9c4fcf4a2990303affae81714a0e683712292715ec70c90222dd1
Instruction ID: e5f8b7ff6ed7eb12d4d56c8b53bb17a33a1268e821a6794e72acaf864e3dfe2d
Opcode Fuzzy Hash: e25d1a989bb9c4fcf4a2990303affae81714a0e683712292715ec70c90222dd1
Instruction Fuzzy Hash: A5221B74A41228CFCB649F70D89869DBBB6BF48305F1085EADA4A93344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CE55, Relevance: 4.9, APIs: 3, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 04e58bb9d69cbf7566250390364b4c55a03e42b2c23010b33b69ed20ddd9cff5
Instruction ID: 613ab0d54c2458aa89256caecddb65d3eb3f7f8b140ca353ba1b3f317f778708
Opcode Fuzzy Hash: 04e58bb9d69cbf7566250390364b4c55a03e42b2c23010b33b69ed20ddd9cff5
Instruction Fuzzy Hash: EF121BB4A41228CFCB649F70D89869DBBB6BF48305F1085EAD94993344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606CE9D, Relevance: 4.9, APIs: 3, Instructions: 435libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606CFE3
KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ecaa49e53af67a2e250a853077e95a2db8c65a8f4af038019effa6e29b1c9afb
Instruction ID: 22c3808e312d6731af13cc945466d421f936c0bc99b70253b913ada2c9945f20
Opcode Fuzzy Hash: ecaa49e53af67a2e250a853077e95a2db8c65a8f4af038019effa6e29b1c9afb
Instruction Fuzzy Hash: 69121BB4A41228CFCB649F70D89869DBBB6BF48305F1081EAD94A93344DF399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0606D344, Relevance: 3.3, APIs: 2, Instructions: 265COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 44c50a22fbf2158e605b50277bce6796541c82d647bb577a7d04ee54af73b9ca
Instruction ID: 8309921082612de7866769c2a2d22f63552e0c6df1ecabf563b614c541607884
Opcode Fuzzy Hash: 44c50a22fbf2158e605b50277bce6796541c82d647bb577a7d04ee54af73b9ca
Instruction Fuzzy Hash: ABC10CB4A41228CFCB64DB30D89479DB7B6BF88206F2081EED60997344DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0606D38C, Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606D3B3
KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5e219ae1f143f541627268b9a86c0040268d8d9913b63a27177dfbdbff1975bc
Instruction ID: 83a84ee8d620abf9aaada87aaec4484a776586b185568f8e85d507f6d816c01f
Opcode Fuzzy Hash: 5e219ae1f143f541627268b9a86c0040268d8d9913b63a27177dfbdbff1975bc
Instruction Fuzzy Hash: 5CC10DB4A41228CFCB64DB30D89479DB7B6BF88205F2081EED60997344DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0606D3D4, Relevance: 1.8, APIs: 1, Instructions: 251COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 0606D3FB

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 553cde0f5e68607b1ff3c225bd9ac39774ba94976167980ebe5802d90486c2d6
Instruction ID: 4a7e2e1b384740c0135a8443ac9aa4bceb9eb4495f291dcdf3e519941cf3420a
Opcode Fuzzy Hash: 553cde0f5e68607b1ff3c225bd9ac39774ba94976167980ebe5802d90486c2d6
Instruction Fuzzy Hash: 4FB11EB4A41228CFCB64DB30D89479DBBB6BF88205F2081EED60997344DB399E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0606FBF0, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0606FC31

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99a08e86d30b4788cad25b0bcbc90d84c9c8cf3f4f9665a8cc1f84fde34c10ea
Instruction ID: 2d3277d163b4b13a0ffea66d431745bf8631a6a7ca0a3318f6a09122e14e8120
Opcode Fuzzy Hash: 99a08e86d30b4788cad25b0bcbc90d84c9c8cf3f4f9665a8cc1f84fde34c10ea
Instruction Fuzzy Hash: A1618D30E50206DFDB54EBB5E4586AEBFF6AF84314F108828E402AB344EF799945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0132516F, Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01325302

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c709e73ccd782d6eadc3f1d3d06417f049c2d28942a37193a3d1dedb616a5477
Instruction ID: e9ca796840f6fa717ff4c9bb217c78098d7e145e7e7ac299a08ec866843815e3
Opcode Fuzzy Hash: c709e73ccd782d6eadc3f1d3d06417f049c2d28942a37193a3d1dedb616a5477
Instruction Fuzzy Hash: 026133B1C043499FDF02CFA9C980ACEBFB1BF49304F29819AE908AB261D3759945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0606B4EC, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0606B633

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0480bef131c9898c0b090a300d2bcc2ca4c992af843267423e616855483b0904
Instruction ID: dadecb38758bd9f66013efa9dacbada96f2d60410e3fc764e030e2cc471cbdca
Opcode Fuzzy Hash: 0480bef131c9898c0b090a300d2bcc2ca4c992af843267423e616855483b0904
Instruction Fuzzy Hash: 8A51E0B0D002188FDB54DFAAC895BDEBBF1BF48314F15812AE815AB351D7789844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0606929C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 0606B633

Memory Dump Source

Source File: 00000004.00000002.916308191.0000000006060000.00000040.00000001.sdmp, Offset: 06060000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1315d40d676752874f2897ae5c06ee5d742d8c1a53659cc8e3dac2fbe07c2c40
Instruction ID: 046d95390956ddaf48a39ef9170dd2d199597343ea8861c2f1813dd4700f0d4b
Opcode Fuzzy Hash: 1315d40d676752874f2897ae5c06ee5d742d8c1a53659cc8e3dac2fbe07c2c40
Instruction Fuzzy Hash: 3151E0B0E002188FDB58DFAAC895BDEBBF5BF48314F148129E815AB351D7789844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F4A950, Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00F4AA59

Memory Dump Source

Source File: 00000004.00000002.911232810.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d392ead5cf48ae840bbdf39a4553dcbf585d7e1d0ee8271c8903487e44d8695c
Instruction ID: a90f0f888ef8a7eb648bfe3793fbd4511a705765652960e51057d159fae14378
Opcode Fuzzy Hash: d392ead5cf48ae840bbdf39a4553dcbf585d7e1d0ee8271c8903487e44d8695c
Instruction Fuzzy Hash: 014124B1E40258DFCB10CFA9C984A9EBFF5BF48314F15806AE819AB341E7749805CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013251F0, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01325302

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2d76a66578308d35380f78802eeee587e3cbdf1d94fbbcc63f975ec6f6a5558d
Instruction ID: d073dd2968258981f8afe2159c18debe1f0dd99c9a89648f43f1f24b5dca5c32
Opcode Fuzzy Hash: 2d76a66578308d35380f78802eeee587e3cbdf1d94fbbcc63f975ec6f6a5558d
Instruction Fuzzy Hash: EA41C0B1D003189FDF14DFAAC984ADEBFB5BF48314F24812AE819AB210D7B49945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F4A698, Relevance: 1.6, APIs: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00F4A79C

Memory Dump Source

Source File: 00000004.00000002.911232810.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d25192988447d6960227ffac5217b50c456f3465eded95d2a3bfe5b04255c685
Instruction ID: 1c64ed70c3cfb226170bc69328ce3e4954f4ea63553453f9cac9599478240f0a
Opcode Fuzzy Hash: d25192988447d6960227ffac5217b50c456f3465eded95d2a3bfe5b04255c685
Instruction Fuzzy Hash: 6D4145B0E003499FDB10CFA9C544A8EFFF5BF49318F29816AE809AB345D7759845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013269C4, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01327D61

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f797da4025815a56f6eaf3b2b95a98e6a545c2ea3537ec9aa973e625094d912e
Instruction ID: e742552738d19448f4be71d3457c78510f98f2aa627e92d0eaccc3bdcd316d38
Opcode Fuzzy Hash: f797da4025815a56f6eaf3b2b95a98e6a545c2ea3537ec9aa973e625094d912e
Instruction Fuzzy Hash: 6C415AB5A00315CFCB14DF59C488AAABBF5FF88318F148849D519A7721D334A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4826C, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00F4AA59

Memory Dump Source

Source File: 00000004.00000002.911232810.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 54fc401d5f74cf7fddb0cd9938d5f44cac67a35dc82bcd9f4fb4c0142062bf9c
Instruction ID: 25290b0e873c6500ad3cb9cfaeb3e486ef58d222083d973521410d89fcbf1e6a
Opcode Fuzzy Hash: 54fc401d5f74cf7fddb0cd9938d5f44cac67a35dc82bcd9f4fb4c0142062bf9c
Instruction Fuzzy Hash: AD31D1B1D40258DFCB10CF9AC984A9EBFF5BF48314F14802AE819AB310D7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F48260, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00F4A79C

Memory Dump Source

Source File: 00000004.00000002.911232810.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 273e46481fce33ca6bf434918308f243ffccbdf29529e5dbfe816acc23138c8c
Instruction ID: bdbb9e00013dacf4eac7f395fcaf68d6d42c9644d538eee6bba844f79214a716
Opcode Fuzzy Hash: 273e46481fce33ca6bf434918308f243ffccbdf29529e5dbfe816acc23138c8c
Instruction Fuzzy Hash: D831E2B1D412499FDB10CF99C584A8EFFF5BF48314F28816AE809AB341C7759949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0132C399, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0132C422

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: f5bb5965e4f6794767fd278b6228d8293ef223257c4d3e4f6a032bfe9b2f69b8
Instruction ID: 89dd3eca5d4d9911990bf36eacd20410974dd7ee659cf14f08ec7c76f500e6b7
Opcode Fuzzy Hash: f5bb5965e4f6794767fd278b6228d8293ef223257c4d3e4f6a032bfe9b2f69b8
Instruction Fuzzy Hash: E931F4B58053848FDB11EF68E51939EBFF4FB05308F14A89AD494EB242C7799509CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01326DD2, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01326E5F

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0e90377d7d31a1be4bd8c5a90509a8b5e06a037e1be886125171abb07d8f7e7c
Instruction ID: 30d0d3b501df836b0a13b9241f431b3f09b870a6d176af771e411935cdabca5d
Opcode Fuzzy Hash: 0e90377d7d31a1be4bd8c5a90509a8b5e06a037e1be886125171abb07d8f7e7c
Instruction Fuzzy Hash: 7A21E6B5900218AFDF10DFA9D985ADEBFF8EB48324F14841AE918A3710D374A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01326DD8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01326E5F

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7263b39bc120cfb91947526d6c2e0a29b2b6db19e5e4143c3facd8fd234d2405
Instruction ID: 2c8fb5e885a65d397c5711e42284b0a43bec358db5e3c930637585fa8748490f
Opcode Fuzzy Hash: 7263b39bc120cfb91947526d6c2e0a29b2b6db19e5e4143c3facd8fd234d2405
Instruction Fuzzy Hash: 3D21C6B59002189FDB10CF99D984ADEBBF4EB48324F14841AE914A7710D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0132C3A8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0132C422

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: e250dce726df3287ed7ad6e6749a710f36c6995b463839a3980a7cfb2ea0dc50
Instruction ID: 88cff33cea793b91ecc35559ff6ed9cc1d7e6c5f374e9c7bd871192bdca684b8
Opcode Fuzzy Hash: e250dce726df3287ed7ad6e6749a710f36c6995b463839a3980a7cfb2ea0dc50
Instruction Fuzzy Hash: 45118C719003188FDF20EFA9C50979EBBF8FB04318F209829D404B7601C7389949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01322F8C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01324276

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cc14c310cf2920ae18b0b4c79b6cd322ae0450b16af45886a69cd36f0e6fb631
Instruction ID: 59ee365b1e90c0c021daf8cf2806b52b55b33f187078f01d280d8d1488629487
Opcode Fuzzy Hash: cc14c310cf2920ae18b0b4c79b6cd322ae0450b16af45886a69cd36f0e6fb631
Instruction Fuzzy Hash: 901132B2C003188FDB20DF9AD444BDEFBF8EB89224F00851AD829B7600C374A549CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0132420A, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01324276

Memory Dump Source

Source File: 00000004.00000002.912563423.0000000001320000.00000040.00000001.sdmp, Offset: 01320000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9835e528768f97989897a298408707c6bd2b3e41a48fde3f871e623f506dfadb
Instruction ID: e2b0221487ebe8fd891c5eaea31356799f500e14cf054aa1fe3ce0f8cc29ec17
Opcode Fuzzy Hash: 9835e528768f97989897a298408707c6bd2b3e41a48fde3f871e623f506dfadb
Instruction Fuzzy Hash: 5F1132B6C003198FDB10DF9AC444BDEFBF4AB89224F00851AD428B7600C374A549CFA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report invoice.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre