Play interactive tour

Edit tour

Analysis Report New Po FRQ M2655TTWQ.exe

Overview

General Information

Sample Name:	New Po FRQ M2655TTWQ.exe
Analysis ID:	432737
MD5:	cd7a1f118ecb64a55254a873c832c5f2
SHA1:	fc4deb1a4133af8fd0ce4b5e79b94c543943ec44
SHA256:	e9f6d4f2c6e8cc971f710c82043c013ad3c9a08f7bbdabea00a694ef37eace04
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

.NET source code contains very large strings

Injects a PE file into a foreign processes

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

New Po FRQ M2655TTWQ.exe (PID: 6344 cmdline: 'C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe' MD5: CD7A1F118ECB64A55254A873C832C5F2)

schtasks.exe (PID: 5376 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

New Po FRQ M2655TTWQ.exe (PID: 2160 cmdline: {path} MD5: CD7A1F118ECB64A55254A873C832C5F2)

New Po FRQ M2655TTWQ.exe (PID: 1288 cmdline: {path} MD5: CD7A1F118ECB64A55254A873C832C5F2)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "faiz@aczfasa.comGvGOxsI4us2.smtp.mailhostbox.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 6344	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 6344	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 1288	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 1288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "faiz@aczfasa.comGvGOxsI4us2.smtp.mailhostbox.com"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\pJqYNehN.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Show sources

Source: New Po FRQ M2655TTWQ.exe

ReversingLabs: Detection: 21%

Source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8

Source: New Po FRQ M2655TTWQ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: New Po FRQ M2655TTWQ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306863283.0000000002F71000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://yprfQg.com
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, New Po FRQ M2655TTWQ.exe, 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE411FED5u002d1652u002d40E7u002d941Au002dA93CE9336C2Eu007d/u003065A82F5u002d42BEu002d4FDAu002d8B33u002dC58F9B84CA4C.cs	Large array initialization: .cctor: array initializer size 12025
Source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bE411FED5u002d1652u002d40E7u002d941Au002dA93CE9336C2Eu007d/u003065A82F5u002d42BEu002d4FDAu002d8B33u002dC58F9B84CA4C.cs	Large array initialization: .cctor: array initializer size 12025

.NET source code contains very large strings

Show sources

Source: New Po FRQ M2655TTWQ.exe, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: pJqYNehN.exe.0.dr, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 0.0.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 0.2.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 16.0.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 16.2.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 17.0.New Po FRQ M2655TTWQ.exe.4d0000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 17.2.New Po FRQ M2655TTWQ.exe.4d0000.1.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 17.0.New Po FRQ M2655TTWQ.exe.4d0000.2.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D82A78	0_2_02D82A78
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D82A68	0_2_02D82A68
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D83F90	0_2_02D83F90
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D83FA0	0_2_02D83FA0
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D81738	0_2_02D81738
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D81728	0_2_02D81728
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D80040	0_2_02D80040
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D80518	0_2_02D80518
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D80508	0_2_02D80508
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_027648E0	17_2_027648E0
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_027647EF	17_2_027647EF
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_02764850	17_2_02764850

Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.308478130.0000000003304000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCnShRJdMfhefwmhveYwMqRNKbDGBqehaWNOkzUm.exe4 vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.305247320.0000000000AD0000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePisi.exeF vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.314836028.0000000007930000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.314836028.0000000007930000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.314080122.0000000007450000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.316095511.000000000D450000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000010.00000002.303292691.0000000000220000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePisi.exeF vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000000.303822980.0000000000540000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePisi.exeF vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.480102527.0000000000C6A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCnShRJdMfhefwmhveYwMqRNKbDGBqehaWNOkzUm.exe4 vs New Po FRQ M2655TTWQ.exe
Source: New Po FRQ M2655TTWQ.exe	Binary or memory string: OriginalFilenamePisi.exeF vs New Po FRQ M2655TTWQ.exe

Source: New Po FRQ M2655TTWQ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: New Po FRQ M2655TTWQ.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: pJqYNehN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: New Po FRQ M2655TTWQ.exe, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: pJqYNehN.exe.0.dr, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 16.0.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 16.2.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/3@0/0

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File created: C:\Users\user\AppData\Roaming\pJqYNehN.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_01

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFE09.tmp

Jump to behavior

Source: New Po FRQ M2655TTWQ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New Po FRQ M2655TTWQ.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File read: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe 'C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe'
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: New Po FRQ M2655TTWQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New Po FRQ M2655TTWQ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: New Po FRQ M2655TTWQ.exe, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: pJqYNehN.exe.0.dr, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.0.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 0.2.New Po FRQ M2655TTWQ.exe.a60000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 16.0.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 16.2.New Po FRQ M2655TTWQ.exe.1b0000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 17.0.New Po FRQ M2655TTWQ.exe.4d0000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 17.2.New Po FRQ M2655TTWQ.exe.4d0000.1.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 17.0.New Po FRQ M2655TTWQ.exe.4d0000.2.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_02D8864D push FFFFFF8Bh; iretd	0_2_02D8864F
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 0_2_05420798 push eax; mov dword ptr [esp], ecx	0_2_0542079C
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_00C5E38A push eax; ret	17_2_00C5E349
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_00C5D95C push eax; ret	17_2_00C5D95D
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_00C5E32B push eax; ret	17_2_00C5E349
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Code function: 17_2_0276DFF0 push FFFFFF8Bh; iretd	17_2_0276DFFB

Source: initial sample	Static PE information: section name: .text entropy: 7.65054137013
Source: initial sample	Static PE information: section name: .text entropy: 7.65054137013

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File created: C:\Users\user\AppData\Roaming\pJqYNehN.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp'

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 6344, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Window / User API: threadDelayed 5302			Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Window / User API: threadDelayed 4486			Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe TID: 6368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe TID: 5952	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe TID: 3868	Thread sleep count: 5302 > 30	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe TID: 3868	Thread sleep count: 4486 > 30	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe TID: 5952	Thread sleep count: 40 > 30	Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: New Po FRQ M2655TTWQ.exe, 00000000.00000002.306924392.0000000002FC5000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Memory written: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Process created: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe {path}	Jump to behavior

Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481005323.0000000001330000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481005323.0000000001330000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481005323.0000000001330000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: New Po FRQ M2655TTWQ.exe, 00000011.00000002.481005323.0000000001330000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 6344, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 1288, type: MEMORY
Source: Yara match	File source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack, type: UNPACKEDPE

Source: Yara match	File source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 1288, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 6344, type: MEMORY
Source: Yara match	File source: Process Memory Space: New Po FRQ M2655TTWQ.exe PID: 1288, type: MEMORY
Source: Yara match	File source: 17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.41d5758.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Po FRQ M2655TTWQ.exe.4038288.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	Security Software Discovery321	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion141	Security Account Manager	Virtualization/Sandbox Evasion141	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Information Discovery113	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
New Po FRQ M2655TTWQ.exe	22%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\pJqYNehN.exe	22%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
17.2.New Po FRQ M2655TTWQ.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File
17.0.New Po FRQ M2655TTWQ.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://yprfQg.com	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.tiro.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://yprfQg.com	New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	New Po FRQ M2655TTWQ.exe, 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	New Po FRQ M2655TTWQ.exe, 00000000.00000002.306863283.0000000002F71000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	New Po FRQ M2655TTWQ.exe, 00000000.00000002.313601809.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	New Po FRQ M2655TTWQ.exe, 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, New Po FRQ M2655TTWQ.exe, 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	432737
Start date:	10.06.2021
Start time:	17:58:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	New Po FRQ M2655TTWQ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/3@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 116 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/432737/sample/New Po FRQ M2655TTWQ.exe

Simulations

Behavior and APIs

Time	Type	Description
18:00:25	API Interceptor	399x Sleep call for process: New Po FRQ M2655TTWQ.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New Po FRQ M2655TTWQ.exe.log Download File
Process:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmpFE09.tmp Download File
Process:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1641
Entropy (8bit):	5.1968787374309775
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBatn:cbh47TlNQ//rydbz9I3YODOLNdq3i
MD5:	28C8BC0F01DD51D8D6A4FC8354026911
SHA1:	017D6BC9FFAACB558279D13BD6D57A9A0A76510E
SHA-256:	F0EB6A6C800F11FFF77EF1717E926CE897D5AABB5CC19A8B9065785BB9C563AC
SHA-512:	D01959B332253A61BDF384E77FCFD873EF0CB7C4B353317BEE2C88D35B360D9F95D79CF5E2BC94137F28CEB7631C938D312933038ADF6FE6399BBFA6B629B3A8
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\pJqYNehN.exe Download File
Process:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	449024
Entropy (8bit):	7.612988345515597
Encrypted:	false
SSDEEP:	6144:6AAu4SZe017Xv5wfX8eCPVKeFQZdKvsDkZxpz99fzBaTesU/IfrPZ0Tqc9:6zuUi7Xv60G+v1TtaTe1IfrPeTR
MD5:	CD7A1F118ECB64A55254A873C832C5F2
SHA1:	FC4DEB1A4133AF8FD0CE4B5E79B94C543943EC44
SHA-256:	E9F6D4F2C6E8CC971F710C82043C013AD3C9A08F7BBDABEA00A694EF37EACE04
SHA-512:	9ACA428A402C9F9543AF46781CD64EAD3AB7ECE29D20D8A7379B561DDAF9ECF018C1D0085A3226AEBD26EE523DB2AA5DA42484A84322A9722B98D8B4B90A2A55
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`..`..............0.................. ........@.. .......................@............@.....................................O.......\.................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc....... ......................@..B........................H.......@...........?....w...l..........................................^.(........}......}.....0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+.....0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p( .....,..o....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.612988345515597
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	New Po FRQ M2655TTWQ.exe
File size:	449024
MD5:	cd7a1f118ecb64a55254a873c832c5f2
SHA1:	fc4deb1a4133af8fd0ce4b5e79b94c543943ec44
SHA256:	e9f6d4f2c6e8cc971f710c82043c013ad3c9a08f7bbdabea00a694ef37eace04
SHA512:	9aca428a402c9f9543af46781cd64ead3ab7ece29d20d8a7379b561ddaf9ecf018c1d0085a3226aebd26ee523db2aa5da42484a84322a9722b98d8b4b90a2a55
SSDEEP:	6144:6AAu4SZe017Xv5wfX8eCPVKeFQZdKvsDkZxpz99fzBaTesU/IfrPZ0Tqc9:6zuUi7Xv60G+v1TtaTe1IfrPeTR
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`..`..............0.................. ........@.. .......................@............@................................

File Icon


Icon Hash:	18da1abcb2d2d2b0

Static PE Info

General
Entrypoint:	0x46e3ea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C21160 [Thu Jun 10 13:19:28 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6e398	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x105c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6c3f0	0x6c400	False	0.853057790849	data	7.65054137013	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x105c	0x1200	False	0.269965277778	data	2.84451863656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x70100	0x8a8	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x709b8	0x14	data
RT_VERSION	0x709dc	0x480	data
RT_MANIFEST	0x70e6c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	December 19th, 2006
Assembly Version	1.0.7.8
InternalName	Pisi.exe
FileVersion	1.0.7.8
CompanyName	Coded by James O'Cull
LegalTrademarks
Comments	Contact management is a solution for anyone who needs to be able to access their list of contacts from removable media without any installation.
ProductName	Contact Management
ProductVersion	1.0.7.8
FileDescription	Contact Management
OriginalFilename	Pisi.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: New Po FRQ M2655TTWQ.exe PID: 6344 Parent PID: 5844

General

Start time:	17:59:45
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe'
Imagebase:	0xa60000
File size:	449024 bytes
MD5 hash:	CD7A1F118ECB64A55254A873C832C5F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.309586760.00000000040FE000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.309299117.0000000003F79000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5376 Parent PID: 6344

General

Start time:	18:00:26
Start date:	10/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\pJqYNehN' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE09.tmp'
Imagebase:	0xb20000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5964 Parent PID: 5376

General

Start time:	18:00:27
Start date:	10/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: New Po FRQ M2655TTWQ.exe PID: 2160 Parent PID: 6344

General

Start time:	18:00:27
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x1b0000
File size:	449024 bytes
MD5 hash:	CD7A1F118ECB64A55254A873C832C5F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: New Po FRQ M2655TTWQ.exe PID: 1288 Parent PID: 6344

General

Start time:	18:00:28
Start date:	10/06/2021
Path:	C:\Users\user\Desktop\New Po FRQ M2655TTWQ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x4d0000
File size:	449024 bytes
MD5 hash:	CD7A1F118ECB64A55254A873C832C5F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000011.00000000.304322118.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.481490878.00000000028E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000011.00000002.478712542.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: New Po FRQ M2655TTWQ.exe PID: 6344 Parent PID: 5844 New Po FRQ M2655TTWQ.exeCOMMON

Executed Functions

Function 02D82A68, Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

1)fY, xrefs: 02D82C1F

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID: 1)fY
API String ID: 0-2136938694
Opcode ID: 56709e054a832c582bae86029ae5de8cff6384764cf1944dfa67c95066ea7281
Instruction ID: 464cebc5fe7dd1a36903f7ecc5718cf75d55ca048f50edff60f224ecc53fc566
Opcode Fuzzy Hash: 56709e054a832c582bae86029ae5de8cff6384764cf1944dfa67c95066ea7281
Instruction Fuzzy Hash: 4B71C074E1120D9BDB14DFE5D9945AEBBB2FF89300F20942AE816AB358DB346942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D82A78, Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

1)fY, xrefs: 02D82C1F

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID: 1)fY
API String ID: 0-2136938694
Opcode ID: d393ba862203017d4f819e0ae95faa1ce5edc5fd4c95746fbe98ee50730a5f18
Instruction ID: f89c005f1a2d6c180efdec2bd39ce1e495abb497ee56723f24ce3131e1dc809e
Opcode Fuzzy Hash: d393ba862203017d4f819e0ae95faa1ce5edc5fd4c95746fbe98ee50730a5f18
Instruction Fuzzy Hash: 0871B174E1120C9BDB14DFE5D9945AEBBB2FF89300F20942AE816AB358DB346942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D854B4, Relevance: 1.6, APIs: 1, Instructions: 146processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02D85613

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 75a043bdd97cfb8fd17563eabe784193cd1db7cedcff722ebafd75b955f64c28
Instruction ID: 141416e353cd4b1ac75e1fa1d155201b42f1541ed51a2c470c8c50e60685f597
Opcode Fuzzy Hash: 75a043bdd97cfb8fd17563eabe784193cd1db7cedcff722ebafd75b955f64c28
Instruction Fuzzy Hash: B5510571900369DFDB10DF99D880BDEBBB6BF48314F1580AAE908A7210DB749E88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02D854C0, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02D85613

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 86c9469d908c08093905c5772a2875acd48eb1287172ee608e5fa8625dda962b
Instruction ID: f3afce80c4f0f3c1c6e28237cd9a5fca9232ee08327ad7621f83cdc78f73ac42
Opcode Fuzzy Hash: 86c9469d908c08093905c5772a2875acd48eb1287172ee608e5fa8625dda962b
Instruction Fuzzy Hash: 6A511571900369DFDB20DF99D880BDDBBB6BF48314F1580AAE908A7210DB749E88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02D85B78, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02D85C0D

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8c9091a5ae2f0ef97b2767cc861d28dcdca84c57f808c8dc538645bb0b110590
Instruction ID: 9173fcac4868f35b43316fb8cd7c28bf2ef035fc4f7956c550adefd1562415bd
Opcode Fuzzy Hash: 8c9091a5ae2f0ef97b2767cc861d28dcdca84c57f808c8dc538645bb0b110590
Instruction Fuzzy Hash: 2E21F4B59002599FCB10CFAAD885BDEFBF4FB48324F04852AE919A7340D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D85B80, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02D85C0D

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 15822336f1a7b9cd9878ec215762acbe52f47ad7c08ba7b1c21123576b30bebc
Instruction ID: 483a919ae6e4c2759955314d572c32f027cf272bd1a0404ef077921555885913
Opcode Fuzzy Hash: 15822336f1a7b9cd9878ec215762acbe52f47ad7c08ba7b1c21123576b30bebc
Instruction Fuzzy Hash: 822114B19002599FCB10CF9AD885BDEBBF4FB48314F40842AE919A3340D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D858E9, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02D8596F

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: affd91cc039010527183a5fbc03c8cf9215565f1a51d0352ba5f7470175be963
Instruction ID: 4ed42e8475d157a08f4791d8810cabec6970ef56b2b64279e052d53f7f7bec18
Opcode Fuzzy Hash: affd91cc039010527183a5fbc03c8cf9215565f1a51d0352ba5f7470175be963
Instruction Fuzzy Hash: BF21F3B59006599FCB10CF9AD884BDEFBF4FB48320F00852AE918A7350D374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D85828, Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 02D858A7

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 919ea2387c845d036e78c488e5002a2118d7bde21f694b88fb252441e499d5b1
Instruction ID: b3b5b1d48f4aa39b85520cf62cf62310234203f213f93030e11625e983768422
Opcode Fuzzy Hash: 919ea2387c845d036e78c488e5002a2118d7bde21f694b88fb252441e499d5b1
Instruction Fuzzy Hash: DD2138B1E006199FCB00CF9AD885BEEFBF4BB48324F55816AE418A7740D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D858F0, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02D8596F

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 9ab205283b8b0c5c8fb18c90f5d9cd6bb477c3a92a23fd880e9b00182fcd305c
Instruction ID: 1499a16c398fdbeb7658e515eea798704fa174fd5f7195c95c9104cd28fd70cb
Opcode Fuzzy Hash: 9ab205283b8b0c5c8fb18c90f5d9cd6bb477c3a92a23fd880e9b00182fcd305c
Instruction Fuzzy Hash: 6C21E2B59006599FCB10DF9AD884BDEFBF4FB48324F50842AE958A7350D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D85830, Relevance: 1.6, APIs: 1, Instructions: 58threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 02D858A7

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 74fee943b6308916ed8b25b0979d377f080e8ff3879ca2909e2015e02bb8c3fe
Instruction ID: f695be130fde415a4236c41647b91f25665512c0ba0def65e7c6e2c3c3f2ac7a
Opcode Fuzzy Hash: 74fee943b6308916ed8b25b0979d377f080e8ff3879ca2909e2015e02bb8c3fe
Instruction Fuzzy Hash: 892108B1D006199FCB00CF9AD9857DEFBF8FB48224F45816AD418A3340D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D859B9, Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02D85A2B

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 82f363ccd10e98f8014f1c1ac2c2a8aab0a6db638ae521be2d0f1828775769cf
Instruction ID: c1b368855ba1964de7d88fb10a2556bfda2f6e0bb80f01f356b40919b9dd5f82
Opcode Fuzzy Hash: 82f363ccd10e98f8014f1c1ac2c2a8aab0a6db638ae521be2d0f1828775769cf
Instruction Fuzzy Hash: 041113B59006489FCB10DF9AD889BDEBFF8FB48324F108419E529A7350D375AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D86458, Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02D864BD

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 69d06f2a618cadfc41aa05112ab4dba89a430bf912f53fabea6b2df5170741bb
Instruction ID: e413f27a5fbbf883552e613f79f841d71b0cd83fa314db358374ac9647b16bde
Opcode Fuzzy Hash: 69d06f2a618cadfc41aa05112ab4dba89a430bf912f53fabea6b2df5170741bb
Instruction Fuzzy Hash: 4B11F5B59007589FDB10DF9AD888BDEBBF8EB48324F10841AE554A7700C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D859C0, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02D85A2B

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: de9ce7bd463bb7d4429cf99eb91dd6f222827bd52f93f233160ea5a6693dc5ed
Instruction ID: 7995a11957194b41e5fbaf92cde500cdf06c6897df17098bec845d8c758ba26d
Opcode Fuzzy Hash: de9ce7bd463bb7d4429cf99eb91dd6f222827bd52f93f233160ea5a6693dc5ed
Instruction Fuzzy Hash: 3A11F2B59006499FCB10DF9AD884BDEBFF8FB48324F108459E529A7310D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D85D30, Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02D85D97

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 824fd82d05422d903c5a08b643b491127df8fa5dba6efd90d8f20c7c4c173e51
Instruction ID: e959bd3c85741ea23eaf8c5fb6a6d6a7636ff00476db3e747954b860b257e04b
Opcode Fuzzy Hash: 824fd82d05422d903c5a08b643b491127df8fa5dba6efd90d8f20c7c4c173e51
Instruction Fuzzy Hash: F01142B59002198FCB10DF9AD488BDEFFF4EB48324F10845AD828A7300D774AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D86460, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02D864BD

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8d8c558df5c932e7f658d175f5ae30b18cc60a1cce7646944e1ada37c2094aa8
Instruction ID: 430387c39af1167cd3535bcf044140c3c122e565e33d34823ed7e5094f2fd407
Opcode Fuzzy Hash: 8d8c558df5c932e7f658d175f5ae30b18cc60a1cce7646944e1ada37c2094aa8
Instruction Fuzzy Hash: 541112B59003589FDB10DF9AC884BDFBBF8EB48324F10841AE958A7300C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D85D38, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02D85D97

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 218024928a94f0815eed7b1af251122f2331d83e024cd32d1bebeed3460d0d6c
Instruction ID: a71187e12efeef3dde5fc46336b90c5dd5aa89d1105551735bcf21b4264491fc
Opcode Fuzzy Hash: 218024928a94f0815eed7b1af251122f2331d83e024cd32d1bebeed3460d0d6c
Instruction Fuzzy Hash: 451123B59006588FCB10DF9AD488BDEFBF8EB48324F10845AD519A7340D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05427BD0, Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

@, xrefs: 05427DA7

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1aeea78cc5fdf6b603617bfb6bbc51e37b6a4d2ef3d31ca5beb535eb9638bdc4
Instruction ID: e83d7f1aa581ea79a23e8e7238443795b71828fc19639af8f3f95ec76ae4439b
Opcode Fuzzy Hash: 1aeea78cc5fdf6b603617bfb6bbc51e37b6a4d2ef3d31ca5beb535eb9638bdc4
Instruction Fuzzy Hash: 58D11B3591021ACFCF19CFA8C5949EDF7B1FF48314B218659D8166B259DB70AE8ACF80

Uniqueness

Uniqueness Score: -1.00%

Function 05427BC2, Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

, xrefs: 05427D73

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2f3d775d9b47793c7e45f4f6caeb8237f6d321c555865d5534499bedb31f0702
Instruction ID: 35560324e024037fcceea1f29fd9526f70408e9e6a2e1dd6e0c7ebdd432e5b90
Opcode Fuzzy Hash: 2f3d775d9b47793c7e45f4f6caeb8237f6d321c555865d5534499bedb31f0702
Instruction Fuzzy Hash: 3FA11C3591021ACFCF05CFA4C5948DDF7B1FF88314B218655D816AB259DB30AA8ACF80

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D766, Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

_, xrefs: 00F2D78F

Memory Dump Source

Source File: 00000000.00000002.305527572.0000000000F2D000.00000040.00000001.sdmp, Offset: 00F2D000, based on PE: false

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 24bcbfe80f51f368796392d5ef69fe9bc672cf42e700e6e5f8ff05fb172bd642
Instruction ID: b810ca28e7649772ae2e628d3387318590773f0c26f33fbdc2d2e65442074bf5
Opcode Fuzzy Hash: 24bcbfe80f51f368796392d5ef69fe9bc672cf42e700e6e5f8ff05fb172bd642
Instruction Fuzzy Hash: 16F082758083608AEB144E29E884355FBD4EF51338F18C55FDD598E286D37DD444EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D7B5, Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

_, xrefs: 00F2D78F

Memory Dump Source

Source File: 00000000.00000002.305527572.0000000000F2D000.00000040.00000001.sdmp, Offset: 00F2D000, based on PE: false

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: ac983c1f7e74667ba71b73ea32e8bcb7064d6cf22c2f58b68c5f5bc295a70eda
Instruction ID: 3c4f00920156deb3a38f9d9869a33cb12fe11dffe943730a0c171816ca21e968
Opcode Fuzzy Hash: ac983c1f7e74667ba71b73ea32e8bcb7064d6cf22c2f58b68c5f5bc295a70eda
Instruction Fuzzy Hash: E8F0A0318083548AEB148E25E888396FBD4EF55338F18C55AD9494F28AE3B89444DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05428378, Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b981ff9d01ec34e0edd609bf0a7a6fe9aa3e23caaf8cc57ded644ad1170f78
Instruction ID: 6d2c7a1dcdb50ab67602b74ad266acba9f45d418543c205a116bd88f5f1627b2
Opcode Fuzzy Hash: 41b981ff9d01ec34e0edd609bf0a7a6fe9aa3e23caaf8cc57ded644ad1170f78
Instruction Fuzzy Hash: C9723031910619CFCB14EF68C899ADDB7B1FF45300F41869AD549AB265EF30AAC9CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05429BF0, Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cf9736b147576f8588bec5aeb508df47abc60e8786ec7ec0d6ffe70502a8bf
Instruction ID: 4916e93379ccf46c26259822b9159128cea69d6b9b7a30dcacc314e8be553a73
Opcode Fuzzy Hash: 69cf9736b147576f8588bec5aeb508df47abc60e8786ec7ec0d6ffe70502a8bf
Instruction Fuzzy Hash: 97223C30A10224CFCB14DF69C884AEDB7B2BF89304F5585A9E90AEB365DB31AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 054284A8, Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec14474be5f0aa5ecff75add4827afd35bfebd1a70176a739db9990a11e4e19
Instruction ID: 36a2f3325fbdc457f7b9c12459a5845ed2df215e9b434e5362f394a5d77ea7fe
Opcode Fuzzy Hash: aec14474be5f0aa5ecff75add4827afd35bfebd1a70176a739db9990a11e4e19
Instruction Fuzzy Hash: D6120D31D106198FCB18DF28C895ADDB7B1FF54304F51829AD54AAB259EF30AE89CF81

Uniqueness

Uniqueness Score: -1.00%

Function 054278F0, Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d422fe3384c16dabfd7cba8fb4544e0194f28f70e081ce5c558761230ae075
Instruction ID: afbf1c964f659f995a95d9d2057df60cc6bfa40deeed6912963918bba57db375
Opcode Fuzzy Hash: 31d422fe3384c16dabfd7cba8fb4544e0194f28f70e081ce5c558761230ae075
Instruction Fuzzy Hash: 4E910A7591061ACFCB01DF68C8849D9FBF5FF49310B14879AE819EB215EB70E985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05424F60, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0257e0451fc7dbc5c63eaed113ad2ca17c56b38491f3241f36205dbcfe37037e
Instruction ID: 70686a12877fd143970ac9acd1de5811df58af9ae072955f7d1973ee8d012d48
Opcode Fuzzy Hash: 0257e0451fc7dbc5c63eaed113ad2ca17c56b38491f3241f36205dbcfe37037e
Instruction Fuzzy Hash: 0D715C74E003298FDB14CFA9C8946EEBBB6FF88314F14852AE405AB350DB349946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05420F18, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da6c9778391fc1aea8011762a7a3e2ccd8722f75217f2c94592fd6e4f118f422
Instruction ID: 8f981dca578b3182f7184419662efa6ac48f9bfea81a24ec93f746af09493ad9
Opcode Fuzzy Hash: da6c9778391fc1aea8011762a7a3e2ccd8722f75217f2c94592fd6e4f118f422
Instruction Fuzzy Hash: A471EBB8700A108FC718DF29C58895ABBF2BF8930471589A9E54ACB372DB72EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05420D38, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3c70cedb47a286b3fcf7b7e666daf37b2b4d17f0b42edf27f28b0febbecb91
Instruction ID: 50cd64221bd750e033d2db2610c8c9ed582b8054a186df1f5b1514ba46e50419
Opcode Fuzzy Hash: 7d3c70cedb47a286b3fcf7b7e666daf37b2b4d17f0b42edf27f28b0febbecb91
Instruction Fuzzy Hash: 5F71B274A14216CFC744CF69D584999FBF1BF4C310B4986AAE84ADB356D730E885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0542F5C8, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4082d546a8acf85f6c806583258e3255a0891287c9cd886ee24276618fa02a70
Instruction ID: 1bf07754ca39ea2b70f42454c91c464a0d140e0e15d86b98f23f14b201df344a
Opcode Fuzzy Hash: 4082d546a8acf85f6c806583258e3255a0891287c9cd886ee24276618fa02a70
Instruction Fuzzy Hash: 4651BD307006249FC715DB68D495A9E77F2FF89304B9089AEE046DB765CB75EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0542B844, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e82843cf8621787f74ed7e8541f05ac4e189c3e21d18a9ccbab8d608e910516
Instruction ID: a72b0057b33bc96cb636e7d8a8067b7752bc5b3e4f2a797caa2f68c6ca8be565
Opcode Fuzzy Hash: 0e82843cf8621787f74ed7e8541f05ac4e189c3e21d18a9ccbab8d608e910516
Instruction Fuzzy Hash: E6515A31A00225AFDB24DBA9D4906EEB7F6FF88204F9045BFC61AD7640DB359D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05429BE1, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d36b22eaef71286949be66a3ac75117c85edc7bb390e423c444b79ef6e3b25
Instruction ID: 8a7bbfdb82bb8ad3c835df0246ba15b29fe7441ebb4aac6e7c126b8d156ea524
Opcode Fuzzy Hash: c9d36b22eaef71286949be66a3ac75117c85edc7bb390e423c444b79ef6e3b25
Instruction Fuzzy Hash: 64518A30B046208FCB14DF79C884A9DB7F2BF89314F5585BDD91A9B3A1DB31AC098B61

Uniqueness

Uniqueness Score: -1.00%

Function 0542BB50, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6df6ad9a64e9407b725c0ea43e93a00dc30122302c022adda64d5c54d2b055
Instruction ID: 6f0e6cddfb01d3c6d58e47f68d3c27539492ad1760d52e7af6789a8256f2922a
Opcode Fuzzy Hash: bc6df6ad9a64e9407b725c0ea43e93a00dc30122302c022adda64d5c54d2b055
Instruction Fuzzy Hash: EA51C370614B218FE735CE39C486B97B7F2FB45204F544E6AE0AACBB50DB74E8458B90

Uniqueness

Uniqueness Score: -1.00%

Function 05425550, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b84a9c0ddf11a89b66add131e87cf1eb69976ba5caff2864f87e9492fdda51d
Instruction ID: 3c7cb543e196695a76e6ecceff3cb927909538a24d34caeaf11808e4a69d1450
Opcode Fuzzy Hash: 5b84a9c0ddf11a89b66add131e87cf1eb69976ba5caff2864f87e9492fdda51d
Instruction Fuzzy Hash: 3B515071E002259FCF14DBAAD858AEFBBF9EF88214F14842AD415E7350DB749905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0542D7F8, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750edb4c439f7594f4d8670c25aff29808c707ccbdf4296ee8de0f9d53ab1f2f
Instruction ID: f11947e5d3d333977dbc7de11eb93eca6aabecf0bd94cfc5a1b6422a79bc029b
Opcode Fuzzy Hash: 750edb4c439f7594f4d8670c25aff29808c707ccbdf4296ee8de0f9d53ab1f2f
Instruction Fuzzy Hash: 05513932D00B1686CB11EF69D850181B3B1FF99324B298B7ADC9C7B305EB71B995CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0542BB41, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e934b28e3846747463481c3691690d0e520efeea3e5741c1e4863c6be733d05c
Instruction ID: 59e73e96e1a7aeba0961216caaba2a4185b9976947a988227d4471eeb3cd975e
Opcode Fuzzy Hash: e934b28e3846747463481c3691690d0e520efeea3e5741c1e4863c6be733d05c
Instruction Fuzzy Hash: 1D51F470614B218FE735CE39C486BA6B7F2FB49204F544E6AE0AACB754DB64E845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0542B8F8, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c636687f0769bc050abcad981e0a3737a6965286e72f6b949965acdde1e558c
Instruction ID: 604285b9574584bf47ad0224daeef6efd0d1987e92b67dc011cee960a2473481
Opcode Fuzzy Hash: 7c636687f0769bc050abcad981e0a3737a6965286e72f6b949965acdde1e558c
Instruction Fuzzy Hash: DC5191706002018BC700EF28D8917D977B2EF82314F5989BDD9199F2A7DB769D0ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05424D1C, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de7929b881e91eafedcb19db0204fd018d588bfba521b3486a8f9fd114875fb
Instruction ID: 50a97828c18210798cc9cc2dd86576c1eb85f83b27109853b1f81a551138bf07
Opcode Fuzzy Hash: 8de7929b881e91eafedcb19db0204fd018d588bfba521b3486a8f9fd114875fb
Instruction Fuzzy Hash: 2A318B70E02229DFCB14DFA1E598AEEFBB2FF89301F52856AE44163355CB319855CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0542B918, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b317d6ad19a29adc8bc1ac8db15fad97feca9bb7b88d6f0b413a4e2b4c2fc0
Instruction ID: 571515a2c404ebba5c44028125740aa363cc499fa3f8939c984b8c788075b522
Opcode Fuzzy Hash: 97b317d6ad19a29adc8bc1ac8db15fad97feca9bb7b88d6f0b413a4e2b4c2fc0
Instruction Fuzzy Hash: 8951A5706102018BCB00EF24D8917E977B2FF81314F59C97CD9199F2AADB769D0ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0542BF90, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f56a79330f916acc9e0dbe02fabc90d771bbea62fd9e6bc530d14d675f6ed8
Instruction ID: 4cb87950e8956a368c4b01d7d24fe4d9eab770ebaf94c8faabf737b38d12e09b
Opcode Fuzzy Hash: 07f56a79330f916acc9e0dbe02fabc90d771bbea62fd9e6bc530d14d675f6ed8
Instruction Fuzzy Hash: CD416070E002389FDB29ABB5C4947EEBAB2EF88254F54546ED506A7340CB354885CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 0542CE97, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8d62b6d045985c1d136fa2c044c833a681ed767359953815ae776d8f874344
Instruction ID: 46f12dce8d11f0c5594153851eeae7bf42a4af7a6ca1ad8ab5a4e0d28bf8e00a
Opcode Fuzzy Hash: fb8d62b6d045985c1d136fa2c044c833a681ed767359953815ae776d8f874344
Instruction Fuzzy Hash: 6F514A72C00B1686CB11EF69D894181B3B1FF993207198B7ADC9C3F205EB71BA95CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0542CEB4, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cfb81b84cb5e0b6b43ab7080f518df040588b852a9e9e5cbc3dd6125bdf282
Instruction ID: b024c99623de027d992b301180b27ce3f20553261483c7886cc4420a525a9a63
Opcode Fuzzy Hash: e5cfb81b84cb5e0b6b43ab7080f518df040588b852a9e9e5cbc3dd6125bdf282
Instruction Fuzzy Hash: 7A510932C10B1696CB11EF69C854181F3B1FF993207158B7ADC9C7B205EB71B994CB80

Uniqueness

Uniqueness Score: -1.00%

Function 054266F8, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a1b4b202e1647a3de812c9c6c56708a37c3ab6ea376c65a931b39b29cb0938
Instruction ID: e0ca569ed23c59b946ac46da7762b79876b31fa5be12a977e2594d9eaf436778
Opcode Fuzzy Hash: 70a1b4b202e1647a3de812c9c6c56708a37c3ab6ea376c65a931b39b29cb0938
Instruction Fuzzy Hash: CB2101757043249FC718ABB998146AA7BEADFC1214F15887AD459C7782DE31DC068352

Uniqueness

Uniqueness Score: -1.00%

Function 054253BC, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7c9e7beda45d24689a6c26a5a658d97bc5f339e9e044c07fecaff1500e81f2
Instruction ID: 06f9ed43d7e34d7ed52ede568360727bef2523c7ab7d01b34fbc3886e9212756
Opcode Fuzzy Hash: 6d7c9e7beda45d24689a6c26a5a658d97bc5f339e9e044c07fecaff1500e81f2
Instruction Fuzzy Hash: FA41E0B1D00228DBDB20CFE9C584ADDFBB5BF48304F64852AD409BB211D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 05420D28, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0901683109214cec32f5483c90923f1d1159c268022aad41a21c4e1ab6b6f51
Instruction ID: ce2bb51c5c4c870060d0a96fccc06729e536bc50609aed0437a53a0bdfe50880
Opcode Fuzzy Hash: d0901683109214cec32f5483c90923f1d1159c268022aad41a21c4e1ab6b6f51
Instruction Fuzzy Hash: F0413B74A14216CFC754CF68C584A9AFBF1FF49310B4586AAE80ADB351D731EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054253C8, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afb6df3ebe3c1f169833c1320f3f364440a9388b8c05767ca7d89830c73176f
Instruction ID: 717af9ee690bc505d082c7a8fd8eb97badee910ef4a430f460dedfb89d35430c
Opcode Fuzzy Hash: 7afb6df3ebe3c1f169833c1320f3f364440a9388b8c05767ca7d89830c73176f
Instruction Fuzzy Hash: 1F41C1B1D002189BDB20CFE9C584ADEFBB5BF48304F64812AD409BB211D7756A4ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 054250E8, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c03313cf43c11b13feda878b57b5aff53bb87eff0edb697db987459bb52d07e
Instruction ID: b714768ed3c912982a744022bae6683aa340b92ffd7d5803b39f2163935ae134
Opcode Fuzzy Hash: 6c03313cf43c11b13feda878b57b5aff53bb87eff0edb697db987459bb52d07e
Instruction Fuzzy Hash: 1441AFB0D103689FDB14CFAAC884ADEFBB5BF48314F64821AE418AB354DB746945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0542BF80, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbddff2e28b27a070c0ddf6f082927e7dd42c2153e27911d7bd90897b3a4c627
Instruction ID: 3828ecf987fd0f6ec5a3d715f93bfc95e3f297c1cb929e3686951e432972cc32
Opcode Fuzzy Hash: dbddff2e28b27a070c0ddf6f082927e7dd42c2153e27911d7bd90897b3a4c627
Instruction Fuzzy Hash: DA319370E012349FDB19ABB584947EEBAB2EF88354F64487EC505A7340DB354845CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 0542553F, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b15c5ecf3035486b75e0021ffae5c0d9d051e2fb84904ff82be5e5631fdc691
Instruction ID: be856affee63b071e810e79045c388ce197a9a76a5fab603536fd6bfaf76515c
Opcode Fuzzy Hash: 4b15c5ecf3035486b75e0021ffae5c0d9d051e2fb84904ff82be5e5631fdc691
Instruction Fuzzy Hash: 79216271F001259BCF11DBAAD814AFFBBFAEFC4600F50856A9519D7250EB719A018790

Uniqueness

Uniqueness Score: -1.00%

Function 054252B0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26de7dd14ffe79ad986e32c1ea2a0c04c7a0f6a8a975692bd42594d3868931a
Instruction ID: a00eca8186dfc7280a3db5579fb4946215555bcd68ed5604127c6abc87560503
Opcode Fuzzy Hash: e26de7dd14ffe79ad986e32c1ea2a0c04c7a0f6a8a975692bd42594d3868931a
Instruction Fuzzy Hash: 9F212B71A043108FC714EB78D8455EBB7F6EF45204705C86AD416CB352EB76DC0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 0542F5B8, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9074b5f8f3be3914b4cf07219684c183c5871026261935f032a735fb291085a1
Instruction ID: b30380231dfd7e7e9e6bda77f444c7e498626ac518f8d11e73e8400253e1c879
Opcode Fuzzy Hash: 9074b5f8f3be3914b4cf07219684c183c5871026261935f032a735fb291085a1
Instruction Fuzzy Hash: 93316130601626ABCB14DF68C585ADEB7F2FF48304F50896DE546EB360CB75AC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0542E3D1, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da500da26748def51d3246818f14bbaf12fc459004175f1780b35ac85efd1af0
Instruction ID: 6f709da1d4b6dbf7cde9d30b3dff6ecaaab73d23658fa8789d186e1c50110602
Opcode Fuzzy Hash: da500da26748def51d3246818f14bbaf12fc459004175f1780b35ac85efd1af0
Instruction Fuzzy Hash: 902187303501204FE708A768C469BFE339AEF88B14F50846EE546CB7E5CEB5EC424790

Uniqueness

Uniqueness Score: -1.00%

Function 05421278, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffd8f18f6ee7bd2868339371d226452aeea19668eb46f28775e52b826081cd2
Instruction ID: 4e2700ce06bbf7d9cab447104e31b9b586d91aaccea18ecc00b4cd54433d6bfd
Opcode Fuzzy Hash: cffd8f18f6ee7bd2868339371d226452aeea19668eb46f28775e52b826081cd2
Instruction Fuzzy Hash: 57312570E04239CBEB14DFA9E458AEEBBF2BB48304F5040A6D905F7350DB319904DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0542E3E0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793a77d1cbf1264c9648227a6c6e1182bae477da4af81450ef4611cacbc1c326
Instruction ID: 14debe78004a954218c679b56678c8d39d7defc52e85720f2b9d3e0a0b41cd26
Opcode Fuzzy Hash: 793a77d1cbf1264c9648227a6c6e1182bae477da4af81450ef4611cacbc1c326
Instruction Fuzzy Hash: CE2166303505214FE718AB68C469BFE339AEF88B14F50846EE546CB7E5CEB5EC428791

Uniqueness

Uniqueness Score: -1.00%

Function 0542C24A, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab63dcf96975d2cc9481bd970fcb2f7831065dcc5900a9925d5392c604253f3
Instruction ID: a297025f77e0301ec3d596f04be028072818ffa814e5b7dba475a4df723080ce
Opcode Fuzzy Hash: 3ab63dcf96975d2cc9481bd970fcb2f7831065dcc5900a9925d5392c604253f3
Instruction Fuzzy Hash: 5D21B271A00229EFCB05DFA0D8549DDBBB2EF88304B55851AF001BB220DF74A959DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0542DBCF, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b037ee22cdc44b0d3fbcec84f4d582999f887b60464a65a565a24132032480
Instruction ID: 5a88c2b42c36f1f2a5cd9af8d3057ba2447278e4afb2b46ddd094f29e3ca9a31
Opcode Fuzzy Hash: 47b037ee22cdc44b0d3fbcec84f4d582999f887b60464a65a565a24132032480
Instruction Fuzzy Hash: 6821FB32A003508BEB05AF29C8946C5BBA1EF96304F0985BEDC4D6F212DB76A544C760

Uniqueness

Uniqueness Score: -1.00%

Function 05428EB8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee3b68597aa2bb920011a26771801625765932c1e8db496322e5faad0fb93b0
Instruction ID: 78242d1c9923692e3594506ee9694ba044287290929138481b119cfabe4c0345
Opcode Fuzzy Hash: 4ee3b68597aa2bb920011a26771801625765932c1e8db496322e5faad0fb93b0
Instruction Fuzzy Hash: 42215031A106199FCB10EF6CD8409DEFBB5FF49351B50C26AE958A7304EB30A995CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0542CEC4, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328617aa8220857670d36c9f161a6ef1805e36364d6af21964b44b7337b8c2aa
Instruction ID: b24fd3c42c19e58e2419da3909333e50e7a8fd3be287810bc2be8deba526d846
Opcode Fuzzy Hash: 328617aa8220857670d36c9f161a6ef1805e36364d6af21964b44b7337b8c2aa
Instruction Fuzzy Hash: BA21DE31A046508BEB05EF29D8986D5B7A1EF95304F4889BEDC4E6F306DF72A544C750

Uniqueness

Uniqueness Score: -1.00%

Function 05421267, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9c6f8c1c3383e906484a9606890108cd65db5df6a49b1e7a1350b477dee7b9
Instruction ID: 2eed08d6cd7ed7cf3d5bef1a493d143a331bcc441c5bbda80adc041d3903a6f3
Opcode Fuzzy Hash: aa9c6f8c1c3383e906484a9606890108cd65db5df6a49b1e7a1350b477dee7b9
Instruction Fuzzy Hash: CD215930E04239CBDB19DFAAE458AEEBBF2BB08304F545466D901FB350DB319901CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D3EC, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305527572.0000000000F2D000.00000040.00000001.sdmp, Offset: 00F2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0a99f4903fed40fdbaca72b0d32b5158bd2ddb97151ca6ff2248cd426d0fdf
Instruction ID: a16ceee48bfef7d21f56513f418a03c79142653349f262b0f60ecb032a961874
Opcode Fuzzy Hash: 5f0a99f4903fed40fdbaca72b0d32b5158bd2ddb97151ca6ff2248cd426d0fdf
Instruction Fuzzy Hash: 87210872504240DFDB05DF00E9C4B16BF61FB94324F34C599E9094F216C336E856EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05420340, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943613dda50d68c28b549612ddf81d6d32725852824f8bd4098644dfe937f261
Instruction ID: 60842cc866f9d19a92c51b86c6c73822085bc5231872ba87ae0fc5f3439b4ea0
Opcode Fuzzy Hash: 943613dda50d68c28b549612ddf81d6d32725852824f8bd4098644dfe937f261
Instruction Fuzzy Hash: D9214D35A00229DFCB14DF69D4888DEB7F6FB88310B40856AE819EB350D770A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0542DEB0, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e964523c87a79348f5e6fb3d80c5783bceb8f3ab076066702236f468f737c53
Instruction ID: 44b31219ba3a8d3e6e0b5d1361ccbf3ddd29668975393ec9dae8bfc273a880b9
Opcode Fuzzy Hash: 7e964523c87a79348f5e6fb3d80c5783bceb8f3ab076066702236f468f737c53
Instruction Fuzzy Hash: 1B115831A04B218BE734CE2AD4917A7B3F2BF84300F544A2EE097CBB40D774E8098B91

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D1EC, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305588752.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838f1b6ce14304604b0c0f10cf820dc7173862e3b0ca6666d91380aed8579c58
Instruction ID: 157543b4c7573acc841180531ec181153d60fa9ac87b2d900d7f2c5c47f62290
Opcode Fuzzy Hash: 838f1b6ce14304604b0c0f10cf820dc7173862e3b0ca6666d91380aed8579c58
Instruction Fuzzy Hash: F411E1B5A04200DFDB05DF50D9C0B66BBA1FF84328F24C6ADE8494B286C336D846EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D034, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305588752.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bba76f56d8ccee16f2e96089b6bcf9eef710215432d4eb1237dd8062f5c6699
Instruction ID: 260354dbf3101708bb16e4b7a6e3b99a970289e47abe815b4710f5b50c6fbc7d
Opcode Fuzzy Hash: 6bba76f56d8ccee16f2e96089b6bcf9eef710215432d4eb1237dd8062f5c6699
Instruction Fuzzy Hash: 1311AFB5904240DFDB14DF54D984B56BB61FF84328F24C6ADE8494B28AC33BD847EB52

Uniqueness

Uniqueness Score: -1.00%

Function 05420330, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a424cc44e3295164fbd9d2f3d77d2e3d35d3f1b87a6fdbb4002081a2cf9cc9
Instruction ID: bc931ec3049ccb60471e85110b9b88b2bdbcbe22dc7bfa4358a0040013f52e3c
Opcode Fuzzy Hash: 56a424cc44e3295164fbd9d2f3d77d2e3d35d3f1b87a6fdbb4002081a2cf9cc9
Instruction Fuzzy Hash: 88114235A042299FCB14DF65C4888DEBBF5FF89310B0585AAE505AB351D771AC49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05421798, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2adda8d81792e72f6596c9ca29e17871076bffea0ae9674af9721284534cd8b2
Instruction ID: 5c959a565004eaa45a3dfbdd43d9f3c86c13de8ffa8ee4078b4585ccd1a1b255
Opcode Fuzzy Hash: 2adda8d81792e72f6596c9ca29e17871076bffea0ae9674af9721284534cd8b2
Instruction Fuzzy Hash: C5110870A002289BDB18EF65D455BDE77F2EF88305F90486DD509AB740CB356D05CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0542DEA0, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e05c96249905c6ff77752f3b75c9f51fac97d980230409787c69e95d7a554f
Instruction ID: fe96fdb396ce77b748df7e9e11484e21dee4ef63a367912b6c2507f17377d28b
Opcode Fuzzy Hash: e2e05c96249905c6ff77752f3b75c9f51fac97d980230409787c69e95d7a554f
Instruction Fuzzy Hash: 6D11C631A04B218BD334CE1AE4517A7B3F2FF84310F444A2EE096C7B40D778E84A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 05420110, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0b8f93af4aba7ef22e4cfd0f8decf25b016b7a270bb4f80ed6f3501f7fff98
Instruction ID: 0dc26b51e8e7c7beecd24ead941c80d35aae7e3c963bf7454bb13719f2d60d47
Opcode Fuzzy Hash: 5f0b8f93af4aba7ef22e4cfd0f8decf25b016b7a270bb4f80ed6f3501f7fff98
Instruction Fuzzy Hash: DB11A331904B219FC724EF7AC8446A6B7F1EF81300B80CA6EE84A5B260EB31D985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05420C98, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcea52c471be61708f8e68e13aa16233749c7b726f33b6cc818b57da4938c01
Instruction ID: 57321532a202ae805fc7e89613ea24ab84e87fcb984287ed42947619403ef932
Opcode Fuzzy Hash: cbcea52c471be61708f8e68e13aa16233749c7b726f33b6cc818b57da4938c01
Instruction Fuzzy Hash: 75115E312096908FC309DB2CD4A5AD53BB1AF07219F1A48EAD186CF673CB26DC45C755

Uniqueness

Uniqueness Score: -1.00%

Function 0542617C, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d733d65a6f20339cd002bb834df0433de9a577718274050f23f22a73e0172a03
Instruction ID: 31ab22153b8309fbc4aaef77d7efb5c886a3e3f0aeb9d9c9d517eee977a83437
Opcode Fuzzy Hash: d733d65a6f20339cd002bb834df0433de9a577718274050f23f22a73e0172a03
Instruction Fuzzy Hash: BB012132B043386BCB08E6B998944EE7FEEDF85224F4584ABE809C3342DE219C024395

Uniqueness

Uniqueness Score: -1.00%

Function 05424F54, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b941636630a6718ac53eefd6e3389fd27caafa1cbd6765663d8d3be9792184cd
Instruction ID: 907cf042360be8d9452774065f6d07da0bc3434da7ae7b6f822d1fc847683557
Opcode Fuzzy Hash: b941636630a6718ac53eefd6e3389fd27caafa1cbd6765663d8d3be9792184cd
Instruction Fuzzy Hash: 6611F3B1D046188FCB10CF9AC444BDEFBF4EB48324F14842AE819A7700D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05424B38, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac04aefdb72833a37190fa6c8a425f43f5df2cbf4362752e39302875ce5717da
Instruction ID: 2c7d75b92b26c5bbb255ff104e621fed34844d2acc46cb65a12b33f395b3d425
Opcode Fuzzy Hash: ac04aefdb72833a37190fa6c8a425f43f5df2cbf4362752e39302875ce5717da
Instruction Fuzzy Hash: 9A11F3B1D046188FCB10CF9AD484ADEFBF4EB48324F14842AE815B7700D774A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05422088, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb8f3888b86f3067c53a68b4c43f2ff89bd01a0056dc9e68086dbb3233bc0b6
Instruction ID: edf3326cd28a7dbde16015d922cd765ccff2b5ef3304e3ad65e2602941c9b2b6
Opcode Fuzzy Hash: 0fb8f3888b86f3067c53a68b4c43f2ff89bd01a0056dc9e68086dbb3233bc0b6
Instruction Fuzzy Hash: 7101C474A001189FDB04AF54D919AABBBF6FB48304F148569E105EB345CA75AC04DB94

Uniqueness

Uniqueness Score: -1.00%

Function 05425861, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cf44e85ba23aaffe4b6318ea77f140b6d70b0b6af5d530bff7d782bbe30cef
Instruction ID: 5f89facac65bca6b3e2f6296aa2daa295dc1b1354c6c3cddf8b561620bd44463
Opcode Fuzzy Hash: e1cf44e85ba23aaffe4b6318ea77f140b6d70b0b6af5d530bff7d782bbe30cef
Instruction Fuzzy Hash: 8F11F0B1D006188FCB10CFAAC484ADEFBF8EB88324F14841AE819A7700D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D47E, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305527572.0000000000F2D000.00000040.00000001.sdmp, Offset: 00F2D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244d724c01b2d6c22a20e988076a75a2e8def0b83eb5a0fa3b4c656e6d5e46ef
Instruction ID: 0861258e7fe4e0e29859734ecc59aac0598f77b2883fb9307228203c563613fe
Opcode Fuzzy Hash: 244d724c01b2d6c22a20e988076a75a2e8def0b83eb5a0fa3b4c656e6d5e46ef
Instruction Fuzzy Hash: BA119E76900244DFCF05DF10E5C4B16BF62FB94324F24C6A9D8090B21AC336D856EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0542A4B7, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0b77ad438e478992bc7d5790e6d55cf9bd6e149ab41bc102ef692a79494940c
Instruction ID: 886f1e1f94dd743e3b8bf799095ae864670fdd1aabcd1ef505632907642c9327
Opcode Fuzzy Hash: c0b77ad438e478992bc7d5790e6d55cf9bd6e149ab41bc102ef692a79494940c
Instruction Fuzzy Hash: 710175357045218FC714DB59E489BAB77E5EF88224F144869E50ACB361CF75EC46C750

Uniqueness

Uniqueness Score: -1.00%

Function 054211C0, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a739f4a26f7b3f3e529a51328f4103e1e72627fd1d6e58b30b94609f9317e3
Instruction ID: addb253eb797caf52e72ec99bf9509db92b425554e613d208ca7e0d83628fc3a
Opcode Fuzzy Hash: a8a739f4a26f7b3f3e529a51328f4103e1e72627fd1d6e58b30b94609f9317e3
Instruction Fuzzy Hash: 6E0121316082345EDB28DBA5A4403EB7BF9EF40261F4018ABE509D7681EF319884CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D0BD, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305588752.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94bc74f88e3879f48efdf0e70654770b8872f68107aa141c7dfe5af54fad3d2
Instruction ID: f12afe79fb4403718b3270c1a063698056d55b1184a623127ba3849efb0ca282
Opcode Fuzzy Hash: c94bc74f88e3879f48efdf0e70654770b8872f68107aa141c7dfe5af54fad3d2
Instruction Fuzzy Hash: 3411AC75904240DFCB15DF10D584B56BBA2FF84328F24C6AAD84A4B39AC336D847DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F8D275, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305588752.0000000000F8D000.00000040.00000001.sdmp, Offset: 00F8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed6f2d4e2c1958489648cc38f948670eb05933b51a422ec2f4d2bdf61ba162a
Instruction ID: 736b01f1673decb65aa44e157305a6848d0f0d59abb6e4c15ccdb688d8448b0f
Opcode Fuzzy Hash: aed6f2d4e2c1958489648cc38f948670eb05933b51a422ec2f4d2bdf61ba162a
Instruction Fuzzy Hash: C111CE75900244DFCB05DF10C5C4B56BBA2FF84328F24CAADD84A4B396C336D846DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05426CEA, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdedfdb0d841717887de88d557831680a3a120e59ae67c0cbef928486c9ce41
Instruction ID: a38a465c0d8f7d131e192bf66d3be144772957efc58c31fd4abb3d99a3e2ea26
Opcode Fuzzy Hash: 4bdedfdb0d841717887de88d557831680a3a120e59ae67c0cbef928486c9ce41
Instruction Fuzzy Hash: 291123B59006588FCB10DFAAC484BDEFBF8EB48324F14851AE919A7300C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0542C01A, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12c1a3a83db1f8846eb9bdfc0a2cdf388183fb20730aebc0a0463639d389ca1
Instruction ID: eb210663a295a307b2ea8564d9f66ecc6e5bc8c8cbe346f9988faf6c4c4d4f7a
Opcode Fuzzy Hash: e12c1a3a83db1f8846eb9bdfc0a2cdf388183fb20730aebc0a0463639d389ca1
Instruction Fuzzy Hash: DB016170E006359FDB28AFB584593EE7AB2AF44314F54446EC406E7280CF3849858FA6

Uniqueness

Uniqueness Score: -1.00%

Function 05422098, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10313f2c5cfd0831f7cfc8b11591cb39f588497fe7b6abf824a9ab8c3bfc0972
Instruction ID: 2d8c475d72fd4f46fd2e7579fcbf3791999385c66eb00423c90fbd197d5d671c
Opcode Fuzzy Hash: 10313f2c5cfd0831f7cfc8b11591cb39f588497fe7b6abf824a9ab8c3bfc0972
Instruction Fuzzy Hash: C601B170A00128DFDB08EF58D919AABBBF6FB88300F148069F105EB344CE759C00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05425DB0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e265bcb93585e4fc7b904d3fe5f0dc4589c249216b040ff8d41c098ba17482e
Instruction ID: 40b0b3f6e9e740e44bb75e1505a552c04d6a2f1fd41f634283e422f3859a6121
Opcode Fuzzy Hash: 3e265bcb93585e4fc7b904d3fe5f0dc4589c249216b040ff8d41c098ba17482e
Instruction Fuzzy Hash: A4F0A431B001359BCF15A7E998556FFBABADB88A10F50082EE919A7340DE350E0287E6

Uniqueness

Uniqueness Score: -1.00%

Function 05420120, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7802c25af175c3a4ee79ada685c857007435c2e1775bfd03255422b919629bb2
Instruction ID: 3c22bce69565c3a0af23637976e8c34156e468358e6abbdfabf170fd8d3c2c08
Opcode Fuzzy Hash: 7802c25af175c3a4ee79ada685c857007435c2e1775bfd03255422b919629bb2
Instruction Fuzzy Hash: 570140306047158FD725EF36C8545AA7BF6EF85340B90C9AEE4469B3A0EB31D946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05426CF0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c6085448cf6d8651ff9414bab47e43daebbb30071263ee905b9a4a3c19d5a9
Instruction ID: 2af8c34f3acd7dcf7fba02e85f48b14382a10951c67c96bc2c348db959034008
Opcode Fuzzy Hash: c0c6085448cf6d8651ff9414bab47e43daebbb30071263ee905b9a4a3c19d5a9
Instruction Fuzzy Hash: A11123B59006588FCB10DFAAC484BDEFBF8EB48324F14841AD919A7300C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05420860, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e6c388d7e7a4570e8b19ab307a49efc1fea4e4a70c1f4a60bb2925dbcfb915
Instruction ID: 32a70823bccb40ed242709bdb42258c6d915a5ab27a4eee1daf8a6892e1e5e65
Opcode Fuzzy Hash: d2e6c388d7e7a4570e8b19ab307a49efc1fea4e4a70c1f4a60bb2925dbcfb915
Instruction Fuzzy Hash: F6F0C2327047115BD7149B6AE88569ABBA5EBC52253084A3AE20AC7211CF62DC058398

Uniqueness

Uniqueness Score: -1.00%

Function 054204DA, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52d0cafa1884fde00c33b7a57878a4cbf37f058fc42a974509f7d12019d95e8
Instruction ID: 1365ddcca6d0ceea63b1d07eea4303ed88eccaf6b92b5408c370a497ab1f4159
Opcode Fuzzy Hash: c52d0cafa1884fde00c33b7a57878a4cbf37f058fc42a974509f7d12019d95e8
Instruction Fuzzy Hash: 5801D131704B248BCB12AB74C8062EEBB79EFC1211F484AADD54A67300EF30E88687C1

Uniqueness

Uniqueness Score: -1.00%

Function 0542A4C8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7405983d834e75f4912debf2d309e330f5b44b2c816227b6ad7e5f3dde440e
Instruction ID: 43d05963dc9ed712a9810fde3e4e25352c8e1a7ca0796fd700ceee8ad0cf0181
Opcode Fuzzy Hash: cc7405983d834e75f4912debf2d309e330f5b44b2c816227b6ad7e5f3dde440e
Instruction Fuzzy Hash: D0014F757046208FC314DB19E488A6BBBEAFF88218B14886DE50ACB361CF71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0542E348, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d579b2ec12b25b38ec356ab260b3ce853994026fdd67ae610672198fd28b07
Instruction ID: 72875f1b06c360b67f9358c75c52d2dfc4ae36053c5c78f47c4a53177013ab83
Opcode Fuzzy Hash: f6d579b2ec12b25b38ec356ab260b3ce853994026fdd67ae610672198fd28b07
Instruction Fuzzy Hash: DF01D631A00619DFCB00EBA8D85A59DBBB5EF81310F014999E549DB362DB75DD81CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05425DC0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b64de640e6a5de8534df0f7223580cc8b29aa953abdc57a6b8149ba7af192eb
Instruction ID: 70b5c1a54522147ea1fe44600910fdd087d89f99808b660db2c8d9d83098f7ef
Opcode Fuzzy Hash: 6b64de640e6a5de8534df0f7223580cc8b29aa953abdc57a6b8149ba7af192eb
Instruction Fuzzy Hash: 70F05B71B101395B8F15B7E9A8545FFBBBADBC8A10B50082ED519A7340DE350D1187E9

Uniqueness

Uniqueness Score: -1.00%

Function 05420558, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2672292f9e72ab2d85a8c4c929965f1ed33b6fbaa0d4df71bd8eba11a07b6d91
Instruction ID: 6d4a8a60dec7475ace58d1d7b9389be3ce76ec07a4bb8ab80e399a8f4940657a
Opcode Fuzzy Hash: 2672292f9e72ab2d85a8c4c929965f1ed33b6fbaa0d4df71bd8eba11a07b6d91
Instruction Fuzzy Hash: 2FF02871300610CFC725DB24D448AEABBF6EF88216B44055EE14A87760DB35EC42C794

Uniqueness

Uniqueness Score: -1.00%

Function 054204E8, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35071cf40705232b2cccc2c5a72baf8f44158a054026dd213f07810018e2610
Instruction ID: a049b759ad7b3408b5dbcb209cb28ffb1db721435d74284c701f6346c8507b72
Opcode Fuzzy Hash: f35071cf40705232b2cccc2c5a72baf8f44158a054026dd213f07810018e2610
Instruction Fuzzy Hash: 31F06235704B248BCB16BB7894094EEB779EFC1211F040AADD54A6B310EF30E58697D1

Uniqueness

Uniqueness Score: -1.00%

Function 0542DF78, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e338c3ddcb65563099b88c488a63a93d065bcf6a1f1f3ca06e0dc663f22ee2
Instruction ID: 46a83ecfb547a3d3f63b4e610803d957e40842078769242ce0d91dc23f8d9bed
Opcode Fuzzy Hash: 63e338c3ddcb65563099b88c488a63a93d065bcf6a1f1f3ca06e0dc663f22ee2
Instruction Fuzzy Hash: D6F017313445308FCB08EB69E498EED37E9AF4866574500EAE10ACB761DA61DC018B88

Uniqueness

Uniqueness Score: -1.00%

Function 0542E358, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19467d6e7a53ebc2e5de6f8776e4949de198a165648038ceb9eb55a69a5e737c
Instruction ID: d12eb37b509e8fda73ca20ed4972cd56835b08d31d67dd14465c37f0ae1c00ac
Opcode Fuzzy Hash: 19467d6e7a53ebc2e5de6f8776e4949de198a165648038ceb9eb55a69a5e737c
Instruction Fuzzy Hash: 52F0AF30A00619DFCB04FBA8C85A89DBBB5EF85300F018599E5099B362EF31AD44CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 05420568, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8b3bf8a78ea934db476d0602b493de43beff10797d85b7552f1b4d2f9f49c1
Instruction ID: 3c874cc34dada779208d0ca07010e743358690672fa2da40886c439a22a21068
Opcode Fuzzy Hash: 0a8b3bf8a78ea934db476d0602b493de43beff10797d85b7552f1b4d2f9f49c1
Instruction Fuzzy Hash: 20F0B431300610CFC7249B1AD48889BB7FAFFC8225710455EE54A87720CF35EC82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0542C3E0, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86486bc0af4af5d77b1e29d3f71a3e236f7989a1a20124bf453ce909d4d914ef
Instruction ID: f7338466aa47982a9f5c944366663cae1343c2a680527dbfaba20eb5376bf8fb
Opcode Fuzzy Hash: 86486bc0af4af5d77b1e29d3f71a3e236f7989a1a20124bf453ce909d4d914ef
Instruction Fuzzy Hash: 37F0E231249371DFC3169F39C4944AA77B6FE1320138488ABD059CB363C626DC42CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0542DF68, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc626768200eae7c0f2a9bee208a0af2869378aa286b460bd94170db3ffda2d
Instruction ID: 86b8c2eaed7713ae969f134d49b2b5e5bd6905883c21c3c7fa26dbe6cbef70b6
Opcode Fuzzy Hash: 7fc626768200eae7c0f2a9bee208a0af2869378aa286b460bd94170db3ffda2d
Instruction Fuzzy Hash: EEF0A0303882708FC705EB79C864DE83BE9AF0A66034A00EBE449CB363DA15DC01C784

Uniqueness

Uniqueness Score: -1.00%

Function 05420CE0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa49f05e279a888631f79ccec8eb5bce572caece46f5bfe241c6a727b4f3b47
Instruction ID: 2c1659f9a329c40337281777de5932cc3fb4979b6f17ce810632e2bc3f3cf01c
Opcode Fuzzy Hash: 4aa49f05e279a888631f79ccec8eb5bce572caece46f5bfe241c6a727b4f3b47
Instruction Fuzzy Hash: BCF0BC342546208FC318DF28D588C997BE5EF4AB1931248A9E10ACB772CBA2EC40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0542C075, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f217a6d27bb6dff9c57323cdf565045ff07888fce42fc1d99d6ec5c0328a7fa
Instruction ID: 3f48c69764773cb16947b553501f0080ae5cad9bc36d97b8628fdcc9cd6fe0b4
Opcode Fuzzy Hash: 8f217a6d27bb6dff9c57323cdf565045ff07888fce42fc1d99d6ec5c0328a7fa
Instruction Fuzzy Hash: 29F01230A406259BDF18AFB694593EE7AB2AF44314F51882ED10AE7680DF7448458FA6

Uniqueness

Uniqueness Score: -1.00%

Function 05425258, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8612df0d881c87f3989b984c657c52785864811b76e58750d380aa5f9944b32
Instruction ID: 9587e785aa945f26c7c474fb7f4af6ac640637ad488f55b1e5df663745e3d04d
Opcode Fuzzy Hash: c8612df0d881c87f3989b984c657c52785864811b76e58750d380aa5f9944b32
Instruction Fuzzy Hash: 7BE06D3451110CEFCB00EBB4EA82ADD7BB5EB45248F908564DC04E3700DB725E019F56

Uniqueness

Uniqueness Score: -1.00%

Function 0542CC37, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0fa17241592d80b09016ad15632edfcdc569f87854ceb29670100aa5ee31e4
Instruction ID: ec600ba224a3ba77a2d2cdcfc6bcb5b2df4452434fea0c70080cb267dd5407c6
Opcode Fuzzy Hash: 4c0fa17241592d80b09016ad15632edfcdc569f87854ceb29670100aa5ee31e4
Instruction Fuzzy Hash: 21E08637A4033AA7CA0071B9F8A57DB33F9D741254F514866D515CB20ADA39CD025BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0542D7E7, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bac2204324a025d2580df19225162477d92ca26ec66c40ed11b01eca8cd4ec9
Instruction ID: f03f993b6bd68825771627375ebf61224ffbfeea118057d3f8c05a31c8858b08
Opcode Fuzzy Hash: 3bac2204324a025d2580df19225162477d92ca26ec66c40ed11b01eca8cd4ec9
Instruction Fuzzy Hash: 54E0C2327496B02B8322125A68288DABFAACCC642034A80ABE409C7316CD698C0743B2

Uniqueness

Uniqueness Score: -1.00%

Function 054266A6, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cff887fbb144e590ada17dc254b4440a0efed6380930a58944b3686855e1ac2
Instruction ID: 236cfc7e15f2d711256ee074d2dd50b99aab313c9fb2a68899dff290bca6eb3b
Opcode Fuzzy Hash: 8cff887fbb144e590ada17dc254b4440a0efed6380930a58944b3686855e1ac2
Instruction Fuzzy Hash: 03E01A7195027DDACB109B81E548BEEBB71FB4465AF218526E142B2940CB760995CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0542CC88, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d38b0ea8c1849c077cb8b4798479b52b63f329629b923b3ad1494a577d0eb5f
Instruction ID: d79b3828bdb76707081ed36605f041161f718de284e6d21337fb551c6e649ec8
Opcode Fuzzy Hash: 5d38b0ea8c1849c077cb8b4798479b52b63f329629b923b3ad1494a577d0eb5f
Instruction Fuzzy Hash: CEE0DF32641320DFC32AAF35D4908AA73E5AF1220538181BFC00D8B721EA32EC41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05421874, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f554cc8a65a742d8092a54c44317fde87b3442494864d68fbb34e75055247711
Instruction ID: f6b48bf16e2d89a5256d62a4a10cb564cb5ecfade2fa80c252e931674595264e
Opcode Fuzzy Hash: f554cc8a65a742d8092a54c44317fde87b3442494864d68fbb34e75055247711
Instruction Fuzzy Hash: 43F03935E01128CFCF18DFA4D1885EDBBF1FB88211F6004AAD10AB2340CB325E00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05425268, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d034f6388f118e96d7dd0bb180ed20e78d6e34ea390a99c93066590072e86f
Instruction ID: f969da26ff552a8611484d54d73bc8ac240a8f81f9945f367fb764b3595c035c
Opcode Fuzzy Hash: e7d034f6388f118e96d7dd0bb180ed20e78d6e34ea390a99c93066590072e86f
Instruction Fuzzy Hash: 4BE04F3461110CEF8B00EFB4E95289DB7F5EB45258B104458D808D7704EB315E00DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0542BF60, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.312418969.0000000005420000.00000040.00000001.sdmp, Offset: 05420000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c11d08ee1df86aff2ddfc17e20e81736ad6d8fbf3dc0ce0ae17574721930bc3
Instruction ID: 26883af41815cfe4c3d55c435d79426d0513c2520d77a1ec32095adbcf44e2e7
Opcode Fuzzy Hash: 2c11d08ee1df86aff2ddfc17e20e81736ad6d8fbf3dc0ce0ae17574721930bc3
Instruction Fuzzy Hash: 71C04C3446621FDFCF80EF14E4587553B73B740305F014992900586318C770A405EF83

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D80040, Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

\]:@, xrefs: 02D802F4

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID: \]:@
API String ID: 0-2542685452
Opcode ID: 6a000bed473088d22c770e18eb232eee0d8ab53c4b90db7134cfb4ec80c835a3
Instruction ID: 14f31dc118ac5a0de275d8698b1f8ab85091c537fadd5bd8f3d8507c7ce9acea
Opcode Fuzzy Hash: 6a000bed473088d22c770e18eb232eee0d8ab53c4b90db7134cfb4ec80c835a3
Instruction Fuzzy Hash: 10C1AD71E0120A8FCB04EFF9C4416AEBBF6AF88355F148529D415E7384EB749E49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D83FA0, Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

cwR, xrefs: 02D84383

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID: cwR
API String ID: 0-1634192762
Opcode ID: be240ed1e3a37ab63863f192d65507b36bd19120c1b2ddc809d7b456d82eb3d4
Instruction ID: aaae4bf5156ebb3d30b62542c66f86cc4f60387cbe2b086f02ca51073d1896a9
Opcode Fuzzy Hash: be240ed1e3a37ab63863f192d65507b36bd19120c1b2ddc809d7b456d82eb3d4
Instruction Fuzzy Hash: DC512A71D0562A8BDB28DF66D9407AAB7B2EF89300F14D2AAD50DA7214EB705E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02D83F90, Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

cwR, xrefs: 02D84383

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID: cwR
API String ID: 0-1634192762
Opcode ID: 37fbf2a7385909d1e66fc56c0c56f17efd1e0f058473b7cddf77e882fdc7f0a7
Instruction ID: f05321447f6c161972906bb27a2b02dc9ac81f2dcd8d818b32baf171bb928e96
Opcode Fuzzy Hash: 37fbf2a7385909d1e66fc56c0c56f17efd1e0f058473b7cddf77e882fdc7f0a7
Instruction Fuzzy Hash: 85511971D1162A8BDB28DF66C944799B7B2BFC9300F14D2EAD50CA7614EB705A818F40

Uniqueness

Uniqueness Score: -1.00%

Function 02D80518, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9622c6eb367af9457834c8bdd6307ae6f6a59a24abd40e52d95bc31dc29e974a
Instruction ID: 8158d5b63a62c9b08ad26820dca6e5357365f2d97c243e590f9b76e31e57e2b2
Opcode Fuzzy Hash: 9622c6eb367af9457834c8bdd6307ae6f6a59a24abd40e52d95bc31dc29e974a
Instruction Fuzzy Hash: 67213571E116189BDB08CFAAD8406EEFBF7AFC8210F14C12AD408A7254EB305A058B61

Uniqueness

Uniqueness Score: -1.00%

Function 02D81738, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cff3739d1c60121fb5f22b2034412da3e8be4065a7e0830878b405e4e767ed3
Instruction ID: 703671da941aac611ddd70b6ff9b634a4d9a2c4dca40e465b42dd06062f580a4
Opcode Fuzzy Hash: 7cff3739d1c60121fb5f22b2034412da3e8be4065a7e0830878b405e4e767ed3
Instruction Fuzzy Hash: 3F112971E116199BDB48CFAAD9406DEFBF7BBC8200F14C43AD408A7314EB309A068F50

Uniqueness

Uniqueness Score: -1.00%

Function 02D80508, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75182c82dab3cc56b028a2ba2adab78bd94d84e3420c6d9319af36b9946e4e8
Instruction ID: 47ebc58a964c37806797ff1083e38a17f2952ca946486607f4ddb7fc2eddef43
Opcode Fuzzy Hash: e75182c82dab3cc56b028a2ba2adab78bd94d84e3420c6d9319af36b9946e4e8
Instruction Fuzzy Hash: D1214AB1E116199BDB08CFAAD9416AEFAF3BFC8200F18C17AD408A7354EB344A018F51

Uniqueness

Uniqueness Score: -1.00%

Function 02D81728, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306571231.0000000002D80000.00000040.00000001.sdmp, Offset: 02D80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218d4e9349c625baea95cd0431f23f4c2bbd29e3d5c9fdf36f632fe4a1c39a3c
Instruction ID: 426c87d23589ac4809f566ce4579e8147ee4b3c4c5565a126b2bb5f831701922
Opcode Fuzzy Hash: 218d4e9349c625baea95cd0431f23f4c2bbd29e3d5c9fdf36f632fe4a1c39a3c
Instruction Fuzzy Hash: AF113770E116199BDB48CFAAD94469EFAF7AFC8300F24C53AD808A7354EB705A468F50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: New Po FRQ M2655TTWQ.exe PID: 1288 Parent PID: 6344 New Po FRQ M2655TTWQ.exeCOMMON

Executed Functions

Function 02766B43, Relevance: 6.2, APIs: 4, Instructions: 153threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02766BE0
GetCurrentThread.KERNEL32 ref: 02766C1D
GetCurrentProcess.KERNEL32 ref: 02766C5A
GetCurrentThreadId.KERNEL32 ref: 02766CB3

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: dec1810d29423e73171d1a91723597882d0efed8548cd88294b98b544c463893
Instruction ID: e7046717de8550f19b29e0791896a490661a6914513e2c2cea0ff2a5d5b3f38b
Opcode Fuzzy Hash: dec1810d29423e73171d1a91723597882d0efed8548cd88294b98b544c463893
Instruction Fuzzy Hash: E161ABB0A057858FEB00CFAAC6887DEBFF4EF59318F14809AD445A7351D738A945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02766B80, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02766BE0
GetCurrentThread.KERNEL32 ref: 02766C1D
GetCurrentProcess.KERNEL32 ref: 02766C5A
GetCurrentThreadId.KERNEL32 ref: 02766CB3

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1b3279da609fb9e4260415e66ba6a151d99cec7b00d00f0879a84af2eba93064
Instruction ID: a31e1a90f83a841314b808834e3d1f9c81cfd12809cd2ca9a63ae3dfde8c9139
Opcode Fuzzy Hash: 1b3279da609fb9e4260415e66ba6a151d99cec7b00d00f0879a84af2eba93064
Instruction Fuzzy Hash: 565168B0A006498FDB54CFAAC6487EEBBF5EF88318F208559E509A7350D738A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 027652C5, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027653E2

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 457d5a580230fc03fd879027abc9841e9a83fc756a4f3b2a3be2ec3659adfe91
Instruction ID: 915761fbe75e4facfd03b0e971b5dd954ff7e12bccc52be7a02c54cd62f8bdb5
Opcode Fuzzy Hash: 457d5a580230fc03fd879027abc9841e9a83fc756a4f3b2a3be2ec3659adfe91
Instruction Fuzzy Hash: BC51C0B1D00319AFDB14CF9AC884ADEBFB5BF48314F64852AE819AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 027652D0, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027653E2

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eb28e55e5b2503e886889aaf1ff020a8c3fafdd43285de8ae28769132e5cb2e7
Instruction ID: 70803ecbadb2f6414744d263206e00c62059b34c1045d2cb8afc068e138af40a
Opcode Fuzzy Hash: eb28e55e5b2503e886889aaf1ff020a8c3fafdd43285de8ae28769132e5cb2e7
Instruction Fuzzy Hash: F541AEB1D00359AFDF14CF9AC884ADEBFB5BF48314F64852AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02766AB4, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02767D39

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cfd854ef5091b1b4667303cffa79a8deaf4a6c44fc2a50a0c9291d35cf808e5e
Instruction ID: 14d2f128e404596f0b4e53cdc5b5ed4b0fd57f63647df5b236cdfc56ed0841a7
Opcode Fuzzy Hash: cfd854ef5091b1b4667303cffa79a8deaf4a6c44fc2a50a0c9291d35cf808e5e
Instruction Fuzzy Hash: 8C413BB4A00345DFDB14CF9AC488AAAFBF5FF88318F158859E915A7361C734A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02766DA1, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02766E2F

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1804246cfc131fb6a412ea55d0dca5a04a526da9bb776e62325fb97ecbabf502
Instruction ID: 9a86073b677b4b04a08b5ced6e58a5ceb5e392b3a701f3e42b3825c933f5160d
Opcode Fuzzy Hash: 1804246cfc131fb6a412ea55d0dca5a04a526da9bb776e62325fb97ecbabf502
Instruction Fuzzy Hash: 7521E6B5D002189FDB10CFA9D584AEEBBF8FB48324F15841AE955A7310D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02766DA8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02766E2F

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 449b29758cff00a0caf7fe7c64dda24cae6f0d28bf17b981fc72e7b3818d6991
Instruction ID: 239a3e9f9c2f5e7ac6c99f4a24831e2e078b4012708c0fda1f1d57421233aa1a
Opcode Fuzzy Hash: 449b29758cff00a0caf7fe7c64dda24cae6f0d28bf17b981fc72e7b3818d6991
Instruction Fuzzy Hash: EA21D5B5D002189FDB10CFAAD584AEEBBF8FB48324F15841AE955A7310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0276C858, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0276C8D2

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c7f7d886acbd34e8b14d2a87cdc053da2de0c70e4dce82ba47f423e452249c79
Instruction ID: aa2b315421964e17bac5e43119c1c97b36edd80d0d72d55ee4331f1858072c38
Opcode Fuzzy Hash: c7f7d886acbd34e8b14d2a87cdc053da2de0c70e4dce82ba47f423e452249c79
Instruction Fuzzy Hash: C2117FB190034A8FDB20DF9AD54D7AEBBF8FB44324F24842ED445A3601D7386544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0276C857, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0276C8D2

Memory Dump Source

Source File: 00000011.00000002.481217822.0000000002760000.00000040.00000001.sdmp, Offset: 02760000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 750e9b9153a6696050ce6eb801037b7d207b6808aaa9867ae035235b52e708c7
Instruction ID: 1b12efb2788e736aa8046859baebdc9a9e4c431b3e9b60d3ee7bc047d5370203
Opcode Fuzzy Hash: 750e9b9153a6696050ce6eb801037b7d207b6808aaa9867ae035235b52e708c7
Instruction Fuzzy Hash: 78114CB190034A8FDB60DFAAD54D3AEBBF4FB48324F24842ED849A7601D7385544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.480031187.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c59abbbefed5e9d3892ab7d0c587cb85cfce27c7c6aa01bf59ac694c584aca6
Instruction ID: cec0f4ecb60f92b969dba85f48909ac13b4a4bee22c79e0254cd3f7b121c7bbc
Opcode Fuzzy Hash: 6c59abbbefed5e9d3892ab7d0c587cb85cfce27c7c6aa01bf59ac694c584aca6
Instruction Fuzzy Hash: 1421D379504344DFDB24DF14D5C4B16BB65FB84315F24C969EC0A4B286C73AD88ACA62

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.480031187.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d2ba1c9e246f6aea23c86c031cd6867e02c3e7533153dcd56d2eeda844ece1
Instruction ID: 6ad69f5748165c23fb1273ad9646f26d84141efb477e835aa22d4610c570fd01
Opcode Fuzzy Hash: a6d2ba1c9e246f6aea23c86c031cd6867e02c3e7533153dcd56d2eeda844ece1
Instruction Fuzzy Hash: 8D2180755093C08FCB12CF20D994715BF71EB86314F28C5EAD8498B6A7C33A994ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report New Po FRQ M2655TTWQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior