Loading ...

Play interactive tourEdit tour

Analysis Report KCTC International Ltd.exe

Overview

General Information

Sample Name:KCTC International Ltd.exe
Analysis ID:432750
MD5:ee4f70f6c82f4474dcda8b825d4ea2b5
SHA1:67d7d08354a2a4485ee5b65799f24aaef176edc3
SHA256:46f7bbcf48ac8f08685112be1ac8d9d8ee7914b23f30524833826f18c5cd5507
Tags:agentteslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains potential unpacker
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Process Start Without DLL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • KCTC International Ltd.exe (PID: 7060 cmdline: 'C:\Users\user\Desktop\KCTC International Ltd.exe' MD5: EE4F70F6C82F4474DCDA8B825D4EA2B5)
    • RegSvcs.exe (PID: 1296 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)
    • RegSvcs.exe (PID: 6516 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)
  • NXLun.exe (PID: 6920 cmdline: 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • NXLun.exe (PID: 6324 cmdline: 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 4600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "shafqat@teknicagroup.comadmin#123mail.teknicagroup.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.0.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              5.0.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                5.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  5.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.KCTC International Ltd.exe.3c2ac98.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 3 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Suspicious Process Start Without DLLShow sources
                      Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\KCTC International Ltd.exe' , ParentImage: C:\Users\user\Desktop\KCTC International Ltd.exe, ParentProcessId: 7060, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 1296
                      Sigma detected: Possible Applocker BypassShow sources
                      Source: Process startedAuthor: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\KCTC International Ltd.exe' , ParentImage: C:\Users\user\Desktop\KCTC International Ltd.exe, ParentProcessId: 7060, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 1296

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Antivirus / Scanner detection for submitted sampleShow sources
                      Source: KCTC International Ltd.exeAvira: detected
                      Found malware configurationShow sources
                      Source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "shafqat@teknicagroup.comadmin#123mail.teknicagroup.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: KCTC International Ltd.exeVirustotal: Detection: 28%Perma Link
                      Source: KCTC International Ltd.exeReversingLabs: Detection: 30%
                      Machine Learning detection for sampleShow sources
                      Source: KCTC International Ltd.exeJoe Sandbox ML: detected
                      Source: 5.0.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 5.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: KCTC International Ltd.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: KCTC International Ltd.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: RegSvcs.pdb, source: NXLun.exe, 0000000A.00000002.744415043.0000000000B52000.00000002.00020000.sdmp, NXLun.exe, 0000000F.00000000.759951358.0000000000152000.00000002.00020000.sdmp, NXLun.exe.5.dr
                      Source: Binary string: RegSvcs.pdb source: NXLun.exe, NXLun.exe.5.dr
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h0_2_0890C070
                      Source: Joe Sandbox ViewIP Address: 192.254.185.244 192.254.185.244
                      Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
                      Source: unknownDNS traffic detected: queries for: mail.teknicagroup.com
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: http://KkGsRl.com
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://cps.letsencrypt.org0
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: RegSvcs.exe, 00000005.00000002.919854304.00000000035CB000.00000004.00000001.sdmpString found in binary or memory: http://mail.teknicagroup.com
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://r3.i.lencr.org/0d
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://r3.o.lencr.org0
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: KCTC International Ltd.exe, 00000000.00000002.674262210.0000000001127000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comasv
                      Source: KCTC International Ltd.exe, 00000000.00000002.674262210.0000000001127000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comicuU
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                      Source: RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919820859.00000000035C1000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919922023.00000000035F0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919938025.00000000035F8000.00000004.00000001.sdmpString found in binary or memory: https://VaT87Qejv0VJff.org
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
                      Source: KCTC International Ltd.exe, 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      Spam, unwanted Advertisements and Ransom Demands:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      System Summary:

                      barindex
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0103C1D00_2_0103C1D0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_010398900_2_01039890
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089037820_2_08903782
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089048B50_2_089048B5
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089068D00_2_089068D0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089068E00_2_089068E0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089048E00_2_089048E0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089000400_2_08900040
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0890C9280_2_0890C928
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089042D80_2_089042D8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089042C90_2_089042C9
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08903AE10_2_08903AE1
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089043970_2_08904397
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089043EF0_2_089043EF
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08908B570_2_08908B57
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0890DC280_2_0890DC28
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08908DC40_2_08908DC4
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08908D4C0_2_08908D4C
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089087920_2_08908792
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08903FC80_2_08903FC8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089037E80_2_089037E8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08997A600_2_08997A60
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899CC880_2_0899CC88
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899AC580_2_0899AC58
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899BDC80_2_0899BDC8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899B3E90_2_0899B3E9
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899B8B00_2_0899B8B0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_08997A510_2_08997A51
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899ABA80_2_0899ABA8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899CC680_2_0899CC68
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899ED780_2_0899ED78
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899EF600_2_0899EF60
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089900060_2_08990006
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899A0390_2_0899A039
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089900400_2_08990040
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_0899F1A80_2_0899F1A8
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089974B00_2_089974B0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089974A00_2_089974A0
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_089954020_2_08995402
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeCode function: 0_2_006170440_2_00617044
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01315A685_2_01315A68
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013127685_2_01312768
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01311FE35_2_01311FE3
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013189985_2_01318998
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0131A1C05_2_0131A1C0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013110495_2_01311049
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0131123F5_2_0131123F
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01310EC15_2_01310EC1
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013300405_2_01330040
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013353485_2_01335348
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133DA785_2_0133DA78
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01331CB85_2_01331CB8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01337C905_2_01337C90
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133BB115_2_0133BB11
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133D23A5_2_0133D23A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133BAAE5_2_0133BAAE
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133D2E25_2_0133D2E2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_01337D485_2_01337D48
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_013334E05_2_013334E0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133CEBA5_2_0133CEBA
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE65085_2_05CE6508
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE71205_2_05CE7120
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE90D85_2_05CE90D8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE68505_2_05CE6850
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE22535_2_05CE2253
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE22605_2_05CE2260
                      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 05CEBEC0 appears 48 times
                      Source: KCTC International Ltd.exe, 00000000.00000002.675412967.0000000003CEB000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs KCTC International Ltd.exe
                      Source: KCTC International Ltd.exe, 00000000.00000002.684001233.0000000008860000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameKygo.dll* vs KCTC International Ltd.exe
                      Source: KCTC International Ltd.exe, 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEOSlmpgXeIIxVgJvqIUpbThMALm.exe4 vs KCTC International Ltd.exe
                      Source: KCTC International Ltd.exe, 00000000.00000000.648707826.0000000000706000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameThreadPoolTaskScheduler.exeZ vs KCTC International Ltd.exe
                      Source: KCTC International Ltd.exeBinary or memory string: OriginalFilenameThreadPoolTaskScheduler.exeZ vs KCTC International Ltd.exe
                      Source: KCTC International Ltd.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: KCTC International Ltd.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@9/6@1/1
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KCTC International Ltd.exe.logJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4600:120:WilError_01
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMutant created: \Sessions\1\BaseNamedObjects\FhbECvgtuUbviEYtIqnG
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_01
                      Source: KCTC International Ltd.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
                      Source: KCTC International Ltd.exeVirustotal: Detection: 28%
                      Source: KCTC International Ltd.exeReversingLabs: Detection: 30%
                      Source: unknownProcess created: C:\Users\user\Desktop\KCTC International Ltd.exe 'C:\Users\user\Desktop\KCTC International Ltd.exe'
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: KCTC International Ltd.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: KCTC International Ltd.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: RegSvcs.pdb, source: NXLun.exe, 0000000A.00000002.744415043.0000000000B52000.00000002.00020000.sdmp, NXLun.exe, 0000000F.00000000.759951358.0000000000152000.00000002.00020000.sdmp, NXLun.exe.5.dr
                      Source: Binary string: RegSvcs.pdb source: NXLun.exe, NXLun.exe.5.dr

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: KCTC International Ltd.exe, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.2.KCTC International Ltd.exe.610000.0.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.0.KCTC International Ltd.exe.610000.0.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133C3DB push 8BFFFFFFh; retf 5_2_0133C3E8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0133CD96 push edx; ret 5_2_0133CDA1
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE1DF9 push ecx; retf 5_2_05CE1DFA
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEB9A3 pushfd ; retf 5_2_05CEB9AA
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEB9A1 pushfd ; retf 5_2_05CEB9A2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE1BC3 push eax; retf 5_2_05CE1BCA
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CE1BC1 push eax; retf 5_2_05CE1BC2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEEBE8 pushad ; ret 5_2_05CEEC29
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEBB1F pushfd ; retf 5_2_05CEBB22
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEBB23 pushfd ; retf 5_2_05CEBB2A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_05CEBA79 pushfd ; retf 5_2_05CEBA7A
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.89994890155
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLunJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLunJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: KCTC International Ltd.exe PID: 7060, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 1596Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 8254Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exe TID: 7064Thread sleep time: -100024s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exe TID: 7088Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 5716Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 3492Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeThread delayed: delay time: 100024Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: RegSvcs.exe, 00000005.00000002.921792706.00000000062F0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: RegSvcs.exe, 00000005.00000002.921792706.00000000062F0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                      Source: RegSvcs.exe, 00000005.00000002.921792706.00000000062F0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: KCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: RegSvcs.exe, 00000005.00000002.922221873.00000000063E6000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: RegSvcs.exe, 00000005.00000002.921792706.00000000062F0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 5_2_0131D088 LdrInitializeThunk,5_2_0131D088
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Writes to foreign memory regionsShow sources
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43A000Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 11F2008Jump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeJump to behavior
                      Source: RegSvcs.exe, 00000005.00000002.919154164.0000000001C50000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: RegSvcs.exe, 00000005.00000002.919154164.0000000001C50000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: RegSvcs.exe, 00000005.00000002.919154164.0000000001C50000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: RegSvcs.exe, 00000005.00000002.919154164.0000000001C50000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Users\user\Desktop\KCTC International Ltd.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\KCTC International Ltd.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Lowering of HIPS / PFW / Operating System Security Settings:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: KCTC International Ltd.exe PID: 7060, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6516, type: MEMORY
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: Yara matchFile source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6516, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: KCTC International Ltd.exe PID: 7060, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6516, type: MEMORY
                      Source: Yara matchFile source: 5.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.KCTC International Ltd.exe.3c2ac98.1.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Registry Run Keys / Startup Folder1Process Injection212File and Directory Permissions Modification1OS Credential Dumping2System Information Discovery114Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsRegistry Run Keys / Startup Folder1Disable or Modify Tools1Credentials in Registry1Query Registry1Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Deobfuscate/Decode Files or Information1Security Account ManagerSecurity Software Discovery211SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information4NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing13LSA SecretsVirtualization/Sandbox Evasion131SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonMasquerading1Cached Domain CredentialsApplication Window Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsVirtualization/Sandbox Evasion131DCSyncRemote System Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobProcess Injection212Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Hidden Files and Directories1/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2 Behavior Graph ID: 432750 Sample: KCTC International Ltd.exe Startdate: 10/06/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 7 other signatures 2->51 6 KCTC International Ltd.exe 3 2->6         started        10 NXLun.exe 2 2->10         started        12 NXLun.exe 1 2->12         started        process3 file4 25 C:\Users\...\KCTC International Ltd.exe.log, ASCII 6->25 dropped 53 Writes to foreign memory regions 6->53 55 Injects a PE file into a foreign processes 6->55 14 RegSvcs.exe 2 4 6->14         started        19 RegSvcs.exe 6->19         started        21 conhost.exe 10->21         started        23 conhost.exe 12->23         started        signatures5 process6 dnsIp7 31 mail.teknicagroup.com 192.254.185.244, 49769, 587 UNIFIEDLAYER-AS-1US United States 14->31 27 C:\Users\user\AppData\Roaming\...27XLun.exe, PE32 14->27 dropped 29 C:\Windows\System32\drivers\etc\hosts, ASCII 14->29 dropped 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->33 35 Tries to steal Mail credentials (via file access) 14->35 37 Tries to harvest and steal ftp login credentials 14->37 43 3 other signatures 14->43 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 19->41 file8 signatures9

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      KCTC International Ltd.exe29%VirustotalBrowse
                      KCTC International Ltd.exe30%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
                      KCTC International Ltd.exe100%AviraHEUR/AGEN.1142734
                      KCTC International Ltd.exe100%Joe Sandbox ML

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\NXLun\NXLun.exe0%MetadefenderBrowse
                      C:\Users\user\AppData\Roaming\NXLun\NXLun.exe0%ReversingLabs

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      0.2.KCTC International Ltd.exe.610000.0.unpack100%AviraHEUR/AGEN.1142734Download File
                      0.0.KCTC International Ltd.exe.610000.0.unpack100%AviraHEUR/AGEN.1142734Download File
                      5.0.RegSvcs.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      5.2.RegSvcs.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://mail.teknicagroup.com0%Avira URL Cloudsafe
                      http://KkGsRl.com0%Avira URL Cloudsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://cps.letsencrypt.org00%URL Reputationsafe
                      http://cps.letsencrypt.org00%URL Reputationsafe
                      http://cps.letsencrypt.org00%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://VaT87Qejv0VJff.org0%Avira URL Cloudsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.fontbureau.comicuU0%Avira URL Cloudsafe
                      https://api.ipify.org%$0%Avira URL Cloudsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.fontbureau.comasv0%Avira URL Cloudsafe
                      http://x1.c.lencr.org/00%URL Reputationsafe
                      http://x1.c.lencr.org/00%URL Reputationsafe
                      http://x1.c.lencr.org/00%URL Reputationsafe
                      http://x1.i.lencr.org/00%URL Reputationsafe
                      http://x1.i.lencr.org/00%URL Reputationsafe
                      http://x1.i.lencr.org/00%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://r3.o.lencr.org00%URL Reputationsafe
                      http://r3.o.lencr.org00%URL Reputationsafe
                      http://r3.o.lencr.org00%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      https://api.ipify.org%GETMozilla/5.00%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://r3.i.lencr.org/0d0%Avira URL Cloudsafe
                      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
                      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
                      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      mail.teknicagroup.com
                      192.254.185.244
                      truetrue
                        unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://127.0.0.1:HTTP/1.1RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        low
                        http://www.apache.org/licenses/LICENSE-2.0KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                          high
                          http://www.fontbureau.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                            high
                            http://www.fontbureau.com/designersGKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                              high
                              http://DynDns.comDynDNSRegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://mail.teknicagroup.comRegSvcs.exe, 00000005.00000002.919854304.00000000035CB000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              http://www.fontbureau.com/designers/?KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                high
                                http://KkGsRl.comRegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.founder.com.cn/cn/bTheKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://cps.letsencrypt.org0RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haRegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.fontbureau.com/designers?KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                  high
                                  https://VaT87Qejv0VJff.orgRegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919820859.00000000035C1000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919922023.00000000035F0000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000002.919938025.00000000035F8000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.tiro.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.fontbureau.com/designersKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                    high
                                    http://www.goodfont.co.krKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssKCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpfalse
                                      high
                                      http://www.fontbureau.comicuUKCTC International Ltd.exe, 00000000.00000002.674262210.0000000001127000.00000004.00000040.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://api.ipify.org%$RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      low
                                      http://www.carterandcone.comlKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.sajatypeworks.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.typography.netDKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.com/designers/cabarga.htmlNKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                        high
                                        http://www.founder.com.cn/cn/cTheKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.galapagosdesign.com/staff/dennis.htmKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://fontfabrik.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.founder.com.cn/cnKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        unknown
                                        http://www.fontbureau.com/designers/frere-user.htmlKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                          high
                                          http://www.fontbureau.comasvKCTC International Ltd.exe, 00000000.00000002.674262210.0000000001127000.00000004.00000040.sdmpfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          http://x1.c.lencr.org/0RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://x1.i.lencr.org/0RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.jiyu-kobo.co.jp/KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://r3.o.lencr.org0RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.galapagosdesign.com/DPleaseKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.fontbureau.com/designers8KCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                            high
                                            https://api.ipify.org%GETMozilla/5.0RegSvcs.exe, 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            low
                                            http://www.fonts.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                              high
                                              http://www.sandoll.co.krKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              http://www.urwpp.deDPleaseKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              http://www.zhongyicts.com.cnKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              unknown
                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameKCTC International Ltd.exe, 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmpfalse
                                                high
                                                http://www.sakkal.comKCTC International Ltd.exe, 00000000.00000002.678841790.0000000005B10000.00000002.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipKCTC International Ltd.exe, 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, RegSvcs.exe, 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown
                                                http://r3.i.lencr.org/0dRegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                                • Avira URL Cloud: safe
                                                unknown
                                                http://cps.root-x1.letsencrypt.org0RegSvcs.exe, 00000005.00000002.922262952.00000000063FC000.00000004.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                unknown

                                                Contacted IPs

                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs

                                                Public

                                                IPDomainCountryFlagASNASN NameMalicious
                                                192.254.185.244
                                                mail.teknicagroup.comUnited States
                                                46606UNIFIEDLAYER-AS-1UStrue

                                                General Information

                                                Joe Sandbox Version:32.0.0 Black Diamond
                                                Analysis ID:432750
                                                Start date:10.06.2021
                                                Start time:18:10:21
                                                Joe Sandbox Product:CloudBasic
                                                Overall analysis duration:0h 10m 25s
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Sample file name:KCTC International Ltd.exe
                                                Cookbook file name:default.jbs
                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                Number of analysed new started processes analysed:23
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:0
                                                Technologies:
                                                • HCA enabled
                                                • EGA enabled
                                                • HDC enabled
                                                • AMSI enabled
                                                Analysis Mode:default
                                                Analysis stop reason:Timeout
                                                Detection:MAL
                                                Classification:mal100.troj.adwa.spyw.evad.winEXE@9/6@1/1
                                                EGA Information:Failed
                                                HDC Information:
                                                • Successful, ratio: 0% (good quality ratio 0%)
                                                • Quality average: 30%
                                                • Quality standard deviation: 30%
                                                HCA Information:
                                                • Successful, ratio: 96%
                                                • Number of executed functions: 110
                                                • Number of non-executed functions: 29
                                                Cookbook Comments:
                                                • Adjust boot time
                                                • Enable AMSI
                                                • Found application associated with file extension: .exe
                                                Warnings:
                                                Show All
                                                • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                                                • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.50.102.62, 13.64.90.137, 168.61.161.212, 92.122.145.220, 20.72.88.19, 2.20.142.210, 2.20.142.209, 20.54.26.129, 20.82.210.154, 92.122.213.194, 92.122.213.247
                                                • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                                                • Not all processes where analyzed, report is missing behavior information
                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                • Report size getting too big, too many NtQueryValueKey calls found.

                                                Simulations

                                                Behavior and APIs

                                                TimeTypeDescription
                                                18:11:17API Interceptor1x Sleep call for process: KCTC International Ltd.exe modified
                                                18:11:34API Interceptor763x Sleep call for process: RegSvcs.exe modified
                                                18:11:45AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NXLun C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                18:11:53AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NXLun C:\Users\user\AppData\Roaming\NXLun\NXLun.exe

                                                Joe Sandbox View / Context

                                                IPs

                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                192.254.185.244OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                  OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                    52 Nos Cylinder52 Nos Cylinder.exeGet hashmaliciousBrowse
                                                      52 Nos Cylinder.exeGet hashmaliciousBrowse
                                                        70654 SSEBACT.exeGet hashmaliciousBrowse
                                                          S.R.L ARIX V.l(MN).exeGet hashmaliciousBrowse
                                                            70654 SSEBACIC EGYPT.exeGet hashmaliciousBrowse
                                                              Payment Slip.exeGet hashmaliciousBrowse
                                                                Payment Slip.exeGet hashmaliciousBrowse
                                                                  ARIX SRLVl (MN) - Italy.exeGet hashmaliciousBrowse
                                                                    ARIX SRLVl (MN) - Italy.exeGet hashmaliciousBrowse
                                                                      ORDER.exeGet hashmaliciousBrowse

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        mail.teknicagroup.comOM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        52 Nos Cylinder52 Nos Cylinder.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        52 Nos Cylinder.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        70654 SSEBACT.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        S.R.L ARIX V.l(MN).exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        70654 SSEBACIC EGYPT.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        Payment Slip.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        Payment Slip.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        ARIX SRLVl (MN) - Italy.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        ARIX SRLVl (MN) - Italy.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        ORDER.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244

                                                                        ASN

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        UNIFIEDLAYER-AS-1USlTAPQJikGw.exeGet hashmaliciousBrowse
                                                                        • 74.220.199.8
                                                                        supply us this product.exeGet hashmaliciousBrowse
                                                                        • 50.87.146.199
                                                                        #U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTMGet hashmaliciousBrowse
                                                                        • 192.185.74.169
                                                                        3arZKnr21W.exeGet hashmaliciousBrowse
                                                                        • 192.254.235.195
                                                                        6b6zVfqxbk.xlsbGet hashmaliciousBrowse
                                                                        • 216.172.184.23
                                                                        HM-20210428 HBL.exeGet hashmaliciousBrowse
                                                                        • 192.254.180.165
                                                                        INQUIRY. ZIP.exeGet hashmaliciousBrowse
                                                                        • 50.87.190.227
                                                                        audit-78958169.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.113.120
                                                                        research-1315978726.xlsbGet hashmaliciousBrowse
                                                                        • 216.172.184.23
                                                                        ExHNIXd73f.exeGet hashmaliciousBrowse
                                                                        • 108.167.142.232
                                                                        research-2012220787.xlsbGet hashmaliciousBrowse
                                                                        • 216.172.184.23
                                                                        research-2012220787.xlsbGet hashmaliciousBrowse
                                                                        • 216.172.184.23
                                                                        viVrtGR9Wg.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.113.120
                                                                        DEMLwnv0Nt.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.113.120
                                                                        audit-367497006.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.113.120
                                                                        analysis-31947858.xlsbGet hashmaliciousBrowse
                                                                        • 108.167.156.223
                                                                        analysis-1593377733.xlsbGet hashmaliciousBrowse
                                                                        • 108.167.156.223
                                                                        research-531942606.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.33.8
                                                                        OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                        • 192.254.185.244
                                                                        research-121105165.xlsbGet hashmaliciousBrowse
                                                                        • 192.185.33.8

                                                                        JA3 Fingerprints

                                                                        No context

                                                                        Dropped Files

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        C:\Users\user\AppData\Roaming\NXLun\NXLun.exeNEW PO#70-02110-00739.exeGet hashmaliciousBrowse
                                                                          New quote.exeGet hashmaliciousBrowse
                                                                            Bank payment information.exeGet hashmaliciousBrowse
                                                                              MESCO TQZ24 QUOTE.exeGet hashmaliciousBrowse
                                                                                SWIFT Msg of USD 78,000.exeGet hashmaliciousBrowse
                                                                                  OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                    ORDER #2348478.exeGet hashmaliciousBrowse
                                                                                      1029BA046DF67EE328AD9D21BFD1E6D31C5CEDC4D4EAD.exeGet hashmaliciousBrowse
                                                                                        Quotation 2000051165.exeGet hashmaliciousBrowse
                                                                                          IMG-20191224-WA0050.jpg.exeGet hashmaliciousBrowse
                                                                                            Note0093746573.exeGet hashmaliciousBrowse
                                                                                              RYJzamn1HwAEPyy.exeGet hashmaliciousBrowse
                                                                                                11.exeGet hashmaliciousBrowse
                                                                                                  OM PHOENIX TRADERS.exeGet hashmaliciousBrowse
                                                                                                    NEW Quotation.exeGet hashmaliciousBrowse
                                                                                                      tB15iC3ImLK3MFX.exeGet hashmaliciousBrowse
                                                                                                        Bank Details.exeGet hashmaliciousBrowse
                                                                                                          swift copy.exeGet hashmaliciousBrowse
                                                                                                            Purchase Order #5038.exeGet hashmaliciousBrowse
                                                                                                              TQ70 DESCO MC.exeGet hashmaliciousBrowse

                                                                                                                Created / dropped Files

                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KCTC International Ltd.exe.log
                                                                                                                Process:C:\Users\user\Desktop\KCTC International Ltd.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1314
                                                                                                                Entropy (8bit):5.350128552078965
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                                                                                                MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                                                                                                SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                                                                                                SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                                                                                                SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                                                                                                Malicious:true
                                                                                                                Reputation:high, very likely benign file
                                                                                                                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a
                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NXLun.exe.log
                                                                                                                Process:C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:modified
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):5.090621108356562
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
                                                                                                                MD5:8C0458BB9EA02D50565175E38D577E35
                                                                                                                SHA1:F0B50702CD6470F3C17D637908F83212FDBDB2F2
                                                                                                                SHA-256:C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
                                                                                                                SHA-512:804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
                                                                                                                Malicious:false
                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..
                                                                                                                C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):45152
                                                                                                                Entropy (8bit):6.149629800481177
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
                                                                                                                MD5:2867A3817C9245F7CF518524DFD18F28
                                                                                                                SHA1:D7BA2A111CEDD5BF523224B3F1CFE58EEC7C2FDC
                                                                                                                SHA-256:43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
                                                                                                                SHA-512:7D3D3DBB42B7966644D716AA9CBC75327B2ACB02E43C61F1DAD4AFE5521F9FE248B33347DFE15B637FB33EB97CDB322BCAEAE08BAE3F2FD863A9AD9B3A4D6B42
                                                                                                                Malicious:true
                                                                                                                Antivirus:
                                                                                                                • Antivirus: Metadefender, Detection: 0%, Browse
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Joe Sandbox View:
                                                                                                                • Filename: NEW PO#70-02110-00739.exe, Detection: malicious, Browse
                                                                                                                • Filename: New quote.exe, Detection: malicious, Browse
                                                                                                                • Filename: Bank payment information.exe, Detection: malicious, Browse
                                                                                                                • Filename: MESCO TQZ24 QUOTE.exe, Detection: malicious, Browse
                                                                                                                • Filename: SWIFT Msg of USD 78,000.exe, Detection: malicious, Browse
                                                                                                                • Filename: OM PHOENIX TRADERS.exe, Detection: malicious, Browse
                                                                                                                • Filename: ORDER #2348478.exe, Detection: malicious, Browse
                                                                                                                • Filename: 1029BA046DF67EE328AD9D21BFD1E6D31C5CEDC4D4EAD.exe, Detection: malicious, Browse
                                                                                                                • Filename: Quotation 2000051165.exe, Detection: malicious, Browse
                                                                                                                • Filename: IMG-20191224-WA0050.jpg.exe, Detection: malicious, Browse
                                                                                                                • Filename: Note0093746573.exe, Detection: malicious, Browse
                                                                                                                • Filename: RYJzamn1HwAEPyy.exe, Detection: malicious, Browse
                                                                                                                • Filename: 11.exe, Detection: malicious, Browse
                                                                                                                • Filename: OM PHOENIX TRADERS.exe, Detection: malicious, Browse
                                                                                                                • Filename: NEW Quotation.exe, Detection: malicious, Browse
                                                                                                                • Filename: tB15iC3ImLK3MFX.exe, Detection: malicious, Browse
                                                                                                                • Filename: Bank Details.exe, Detection: malicious, Browse
                                                                                                                • Filename: swift copy.exe, Detection: malicious, Browse
                                                                                                                • Filename: Purchase Order #5038.exe, Detection: malicious, Browse
                                                                                                                • Filename: TQ70 DESCO MC.exe, Detection: malicious, Browse
                                                                                                                Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zX.Z..............0..d..........V.... ........@.. ..............................."....`.....................................O.......8............r..`>.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........|...P...........................................r...p(....*2.(....(....*z..r...p(....(....(......}....*..{....*.s.........*.0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t......*..0..(....... ....s$........o%....X..(....-..*.o&...*.0...........('......&.....*.*...................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...
                                                                                                                C:\Windows\System32\drivers\etc\hosts
                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:modified
                                                                                                                Size (bytes):11
                                                                                                                Entropy (8bit):2.663532754804255
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:iLE:iLE
                                                                                                                MD5:B24D295C1F84ECBFB566103374FB91C5
                                                                                                                SHA1:6A750D3F8B45C240637332071D34B403FA1FF55A
                                                                                                                SHA-256:4DC7B65075FBC5B5421551F0CB814CAFDC8CACA5957D393C222EE388B6F405F4
                                                                                                                SHA-512:9BE279BFA70A859608B50EF5D30BF2345F334E5F433C410EA6A188DCAB395BFF50C95B165177E59A29261464871C11F903A9ECE55B2D900FE49A9F3C49EB88FA
                                                                                                                Malicious:true
                                                                                                                Preview: ..127.0.0.1
                                                                                                                \Device\ConDrv
                                                                                                                Process:C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1141
                                                                                                                Entropy (8bit):4.44831826838854
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
                                                                                                                MD5:1AEB3A784552CFD2AEDEDC1D43A97A4F
                                                                                                                SHA1:804286AB9F8B3DE053222826A69A7CDA3492411A
                                                                                                                SHA-256:0BC438F4B1208E1390C12D375B6CBB08BF47599D1F24BD07799BB1DF384AA293
                                                                                                                SHA-512:5305059BA86D5C2185E590EC036044B2A17ED9FD9863C2E3C7E7D8035EF0C79E53357AF5AE735F7D432BC70156D4BD3ACB42D100CFB05C2FB669EA22368F1415
                                                                                                                Malicious:false
                                                                                                                Preview: Microsoft (R) .NET Framework Services Installation Utility Version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

                                                                                                                Static File Info

                                                                                                                General

                                                                                                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Entropy (8bit):7.895155642403185
                                                                                                                TrID:
                                                                                                                • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                • Windows Screen Saver (13104/52) 0.07%
                                                                                                                • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                File name:KCTC International Ltd.exe
                                                                                                                File size:991232
                                                                                                                MD5:ee4f70f6c82f4474dcda8b825d4ea2b5
                                                                                                                SHA1:67d7d08354a2a4485ee5b65799f24aaef176edc3
                                                                                                                SHA256:46f7bbcf48ac8f08685112be1ac8d9d8ee7914b23f30524833826f18c5cd5507
                                                                                                                SHA512:6f367102839d237b06d170263741fdb8539b6a0e4a1fed461cdd576c7a360fc367311b91600c3303e26d8912ef40f79bcfb60d303e4c0d263c78a9a4fb76d9c7
                                                                                                                SSDEEP:24576:e8lH78V7CSjXAy6cJSvysu8zRMglpERIIw/cqNeBUdtqC:bF7QCEQy6RvyeMg7ER8/3wBUj
                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`............................b2... ...@....@.. ....................................@................................

                                                                                                                File Icon

                                                                                                                Icon Hash:00828e8e8686b000

                                                                                                                Static PE Info

                                                                                                                General

                                                                                                                Entrypoint:0x4f3262
                                                                                                                Entrypoint Section:.text
                                                                                                                Digitally signed:false
                                                                                                                Imagebase:0x400000
                                                                                                                Subsystem:windows gui
                                                                                                                Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                                                                                                DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                                                                                Time Stamp:0x60C1D57F [Thu Jun 10 09:03:59 2021 UTC]
                                                                                                                TLS Callbacks:
                                                                                                                CLR (.Net) Version:v4.0.30319
                                                                                                                OS Version Major:4
                                                                                                                OS Version Minor:0
                                                                                                                File Version Major:4
                                                                                                                File Version Minor:0
                                                                                                                Subsystem Version Major:4
                                                                                                                Subsystem Version Minor:0
                                                                                                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                Entrypoint Preview

                                                                                                                Instruction
                                                                                                                jmp dword ptr [00402000h]
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al
                                                                                                                add byte ptr [eax], al

                                                                                                                Data Directories

                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xf32080x57.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xf60000x64c.rsrc
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xf40000xc.reloc
                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                Sections

                                                                                                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                .text0x20000xf12680xf1400False0.897940616904data7.89994890155IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                .reloc0xf40000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                .rsrc0xf60000x64c0x800False0.34423828125data4.51401701413IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                Resources

                                                                                                                NameRVASizeTypeLanguageCountry
                                                                                                                RT_VERSION0xf60a00x3f8data
                                                                                                                RT_MANIFEST0xf64980x1b4XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

                                                                                                                Imports

                                                                                                                DLLImport
                                                                                                                mscoree.dll_CorExeMain

                                                                                                                Version Infos

                                                                                                                DescriptionData
                                                                                                                Translation0x0000 0x04b0
                                                                                                                LegalCopyrightCopyright Sutton Grammar School 2015
                                                                                                                Assembly Version1.0.0.0
                                                                                                                InternalNameThreadPoolTaskScheduler.exe
                                                                                                                FileVersion1.0.0.0
                                                                                                                CompanyNameSutton Grammar School
                                                                                                                LegalTrademarks
                                                                                                                Comments
                                                                                                                ProductNameAspiring Rookie - Basketball
                                                                                                                ProductVersion1.0.0.0
                                                                                                                FileDescriptionAspiring Rookie - Basketball
                                                                                                                OriginalFilenameThreadPoolTaskScheduler.exe

                                                                                                                Network Behavior

                                                                                                                Network Port Distribution

                                                                                                                TCP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                Jun 10, 2021 18:13:04.135503054 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:04.322071075 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:04.322395086 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:05.846622944 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:05.847050905 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.034794092 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.035535097 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.227665901 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.279107094 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.327569962 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.533374071 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.533412933 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.533436060 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.533451080 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.533469915 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.533596992 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.533651114 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.544455051 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.733282089 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:06.779083967 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:06.993788958 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:07.180464983 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:07.182280064 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:07.369291067 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:07.386154890 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:07.613444090 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:08.617824078 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:08.618943930 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:08.805367947 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:08.806183100 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:08.997991085 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:08.998604059 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:09.186605930 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.189064980 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:09.189405918 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:09.190143108 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:09.190396070 CEST49769587192.168.2.4192.254.185.244
                                                                                                                Jun 10, 2021 18:13:09.376245022 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.376532078 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.377181053 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.377276897 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.377289057 CEST58749769192.254.185.244192.168.2.4
                                                                                                                Jun 10, 2021 18:13:09.435595036 CEST49769587192.168.2.4192.254.185.244

                                                                                                                UDP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                Jun 10, 2021 18:11:03.252214909 CEST5912353192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:03.311182976 CEST53591238.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:03.574759960 CEST5453153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:03.644349098 CEST53545318.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:04.449028015 CEST4971453192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:04.499839067 CEST53497148.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:06.223465919 CEST5802853192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:06.283236980 CEST53580288.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:06.424508095 CEST5309753192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:06.486016989 CEST53530978.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:07.585011005 CEST4925753192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:07.640558004 CEST53492578.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:08.561192036 CEST6238953192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:08.611665010 CEST53623898.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:09.862551928 CEST4991053192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:09.917599916 CEST53499108.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:11.231658936 CEST5585453192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:11.284584999 CEST53558548.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:12.400094032 CEST6454953192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:12.450527906 CEST53645498.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:13.906141996 CEST6315353192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:13.956517935 CEST53631538.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:15.253635883 CEST5299153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:15.303709030 CEST53529918.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:16.325102091 CEST5370053192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:16.377464056 CEST53537008.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:17.466587067 CEST5172653192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:17.516786098 CEST53517268.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:18.647921085 CEST5679453192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:18.701282024 CEST53567948.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:19.621459007 CEST5653453192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:19.672553062 CEST53565348.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:20.610757113 CEST5662753192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:20.660936117 CEST53566278.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:21.559803963 CEST5662153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:21.610138893 CEST53566218.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:22.503149033 CEST6311653192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:22.561443090 CEST53631168.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:23.669218063 CEST6407853192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:23.719496965 CEST53640788.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:24.681145906 CEST6480153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:24.731286049 CEST53648018.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:27.148103952 CEST6172153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:27.200999975 CEST53617218.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:37.605969906 CEST5125553192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:37.676702976 CEST53512558.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:56.341928959 CEST6152253192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:56.500992060 CEST53615228.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:57.497968912 CEST5233753192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:57.530162096 CEST5504653192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:57.572721958 CEST53523378.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:57.596152067 CEST53550468.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:58.273283958 CEST4961253192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:58.343139887 CEST53496128.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:58.673928976 CEST4928553192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:58.735614061 CEST53492858.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:11:59.616147041 CEST5060153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:11:59.779635906 CEST53506018.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:01.250866890 CEST6087553192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:01.312902927 CEST53608758.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:02.881325960 CEST5644853192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:02.945550919 CEST53564488.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:04.002738953 CEST5917253192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:04.066457033 CEST53591728.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:05.376183033 CEST6242053192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:05.430954933 CEST53624208.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:06.894591093 CEST6057953192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:06.957489014 CEST53605798.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:07.706733942 CEST5018353192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:07.768219948 CEST53501838.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:12.917491913 CEST6153153192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:12.979947090 CEST53615318.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:13.166806936 CEST4922853192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:13.243561029 CEST53492288.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:16.942131996 CEST5979453192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:17.001995087 CEST53597948.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:49.834350109 CEST5591653192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:49.894512892 CEST53559168.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:12:51.217277050 CEST5275253192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:12:51.276684999 CEST53527528.8.8.8192.168.2.4
                                                                                                                Jun 10, 2021 18:13:03.797770977 CEST6054253192.168.2.48.8.8.8
                                                                                                                Jun 10, 2021 18:13:03.996293068 CEST53605428.8.8.8192.168.2.4

                                                                                                                DNS Queries

                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                Jun 10, 2021 18:13:03.797770977 CEST192.168.2.48.8.8.80x3e64Standard query (0)mail.teknicagroup.comA (IP address)IN (0x0001)

                                                                                                                DNS Answers

                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                Jun 10, 2021 18:13:03.996293068 CEST8.8.8.8192.168.2.40x3e64No error (0)mail.teknicagroup.com192.254.185.244A (IP address)IN (0x0001)

                                                                                                                SMTP Packets

                                                                                                                TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                Jun 10, 2021 18:13:05.846622944 CEST58749769192.254.185.244192.168.2.4220-gator3160.hostgator.com ESMTP Exim 4.94.2 #2 Thu, 10 Jun 2021 11:13:05 -0500
                                                                                                                220-We do not authorize the use of this system to transport unsolicited,
                                                                                                                220 and/or bulk e-mail.
                                                                                                                Jun 10, 2021 18:13:05.847050905 CEST49769587192.168.2.4192.254.185.244EHLO 082561
                                                                                                                Jun 10, 2021 18:13:06.034794092 CEST58749769192.254.185.244192.168.2.4250-gator3160.hostgator.com Hello 082561 [84.17.52.18]
                                                                                                                250-SIZE 52428800
                                                                                                                250-8BITMIME
                                                                                                                250-PIPELINING
                                                                                                                250-PIPE_CONNECT
                                                                                                                250-AUTH PLAIN LOGIN
                                                                                                                250-STARTTLS
                                                                                                                250 HELP
                                                                                                                Jun 10, 2021 18:13:06.035535097 CEST49769587192.168.2.4192.254.185.244STARTTLS
                                                                                                                Jun 10, 2021 18:13:06.227665901 CEST58749769192.254.185.244192.168.2.4220 TLS go ahead

                                                                                                                Code Manipulations

                                                                                                                Statistics

                                                                                                                CPU Usage

                                                                                                                Click to jump to process

                                                                                                                Memory Usage

                                                                                                                Click to jump to process

                                                                                                                High Level Behavior Distribution

                                                                                                                Click to dive into process behavior distribution

                                                                                                                Behavior

                                                                                                                Click to jump to process

                                                                                                                System Behavior

                                                                                                                General

                                                                                                                Start time:18:11:09
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Users\user\Desktop\KCTC International Ltd.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:'C:\Users\user\Desktop\KCTC International Ltd.exe'
                                                                                                                Imagebase:0x610000
                                                                                                                File size:991232 bytes
                                                                                                                MD5 hash:EE4F70F6C82F4474DCDA8B825D4EA2B5
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Yara matches:
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.674962661.0000000003AD9000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.674438416.0000000002AD1000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                Reputation:low

                                                                                                                General

                                                                                                                Start time:18:11:19
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                Imagebase:0x3d0000
                                                                                                                File size:45152 bytes
                                                                                                                MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high

                                                                                                                General

                                                                                                                Start time:18:11:19
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                Imagebase:0xeb0000
                                                                                                                File size:45152 bytes
                                                                                                                MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Yara matches:
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000000.670149487.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.919459230.0000000003261000.00000004.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                                                • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.917793133.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                                                                                                Reputation:high

                                                                                                                General

                                                                                                                Start time:18:11:53
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                                                                                                                Imagebase:0xb50000
                                                                                                                File size:45152 bytes
                                                                                                                MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Antivirus matches:
                                                                                                                • Detection: 0%, Metadefender, Browse
                                                                                                                • Detection: 0%, ReversingLabs
                                                                                                                Reputation:high

                                                                                                                General

                                                                                                                Start time:18:11:54
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff724c50000
                                                                                                                File size:625664 bytes
                                                                                                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high

                                                                                                                General

                                                                                                                Start time:18:12:01
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                                                                                                                Imagebase:0x150000
                                                                                                                File size:45152 bytes
                                                                                                                MD5 hash:2867A3817C9245F7CF518524DFD18F28
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:.Net C# or VB.NET
                                                                                                                Reputation:high

                                                                                                                General

                                                                                                                Start time:18:12:02
                                                                                                                Start date:10/06/2021
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff724c50000
                                                                                                                File size:625664 bytes
                                                                                                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high

                                                                                                                Disassembly

                                                                                                                Code Analysis

                                                                                                                Reset < >

                                                                                                                  Executed Functions

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: $=e
                                                                                                                  • API String ID: 0-3143251092
                                                                                                                  • Opcode ID: 7718a8732b3218b84e48b3731303386597b84a9e943f1e8c959eaddf3daf5209
                                                                                                                  • Instruction ID: 9fcfc298057b0ada24e81a546bde34e72274263ed7eb9ec6c8865afac1f288d0
                                                                                                                  • Opcode Fuzzy Hash: 7718a8732b3218b84e48b3731303386597b84a9e943f1e8c959eaddf3daf5209
                                                                                                                  • Instruction Fuzzy Hash: CCD17D70E0520ADFCB04DFAAC9858AEFBB2FF89345F15C959C446A7214D334AA42CF90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: $=e
                                                                                                                  • API String ID: 0-3143251092
                                                                                                                  • Opcode ID: ebcc7c7d99db1806e6d11ebf30dc0c4e089602a820b99d8b55c6c2afdd9cb91b
                                                                                                                  • Instruction ID: 9deef4ed9cb1ce7eb4a868eb23ef4dc098b859898b7fa88e6a3ec30d050a063d
                                                                                                                  • Opcode Fuzzy Hash: ebcc7c7d99db1806e6d11ebf30dc0c4e089602a820b99d8b55c6c2afdd9cb91b
                                                                                                                  • Instruction Fuzzy Hash: FCD16C70E0520ADFCB04DF9AC9858AEFBB2FF89345F51C959C446AB214D334AA42CF94
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: m);
                                                                                                                  • API String ID: 0-3539380329
                                                                                                                  • Opcode ID: e28eff5a045ec8394a7ff5c63eba3d675bc19ad5f1f961633f4a97947d283d25
                                                                                                                  • Instruction ID: b37383be46038b3fdf1e0d195155c1f7fa9716fd65d9fea7f9cf03df82a94d1c
                                                                                                                  • Opcode Fuzzy Hash: e28eff5a045ec8394a7ff5c63eba3d675bc19ad5f1f961633f4a97947d283d25
                                                                                                                  • Instruction Fuzzy Hash: D9B177B4E062588FCB04DFA9C4446DEFFF2EF89304F14882AE845AB295DB759806CF55
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: m);
                                                                                                                  • API String ID: 0-3539380329
                                                                                                                  • Opcode ID: c346d8618df51c661637f51556c71b90b2c74931eaee67938961cbafd43ab9ad
                                                                                                                  • Instruction ID: 12b6180bb932f9c14fa4b35621c94634b468e58479ea2661384efbf1115eb955
                                                                                                                  • Opcode Fuzzy Hash: c346d8618df51c661637f51556c71b90b2c74931eaee67938961cbafd43ab9ad
                                                                                                                  • Instruction Fuzzy Hash: 158101B4E012188FCB48DFAAC885ADEBBF2FF89301F10842AD519AB354D7309945CF64
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: ]Bgn
                                                                                                                  • API String ID: 0-3951812850
                                                                                                                  • Opcode ID: 74d582a02348c2742e237c3a84684bc3630b54f943de912cd53da5e55048bb4a
                                                                                                                  • Instruction ID: be78d1f08d31f90b1173f7c9fd9929a659e4bffa95b5ab355669b9a815bce7d6
                                                                                                                  • Opcode Fuzzy Hash: 74d582a02348c2742e237c3a84684bc3630b54f943de912cd53da5e55048bb4a
                                                                                                                  • Instruction Fuzzy Hash: 6E41CB70E0A289CFDB04CFA9E8455EEBFF2FF8A200F0894AAC954AB355D6354545CF61
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: ]Bgn
                                                                                                                  • API String ID: 0-3951812850
                                                                                                                  • Opcode ID: fea0a9d23072feaed15c08a9d7cb5d37af3e7418f1bb5ee478dc3cab4fc8b8f8
                                                                                                                  • Instruction ID: 0d1e6bc6c69a34564d527cb01e8fba3bd6adcdef5476ed5a71ef18703f3943b7
                                                                                                                  • Opcode Fuzzy Hash: fea0a9d23072feaed15c08a9d7cb5d37af3e7418f1bb5ee478dc3cab4fc8b8f8
                                                                                                                  • Instruction Fuzzy Hash: CC41CA70E0A2898FDB04CFB9D8455DEBFF2FF8A200F0895AAC954AB211D2354509CF61
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 27a58ffa8013a4b441c6e4cd599a47b2b30b4cadf7c70a973ec951d3c88d66da
                                                                                                                  • Instruction ID: 04b5cd80cad3dbef0b354298d547631f71d4713385d15105a96ab6736a47e0aa
                                                                                                                  • Opcode Fuzzy Hash: 27a58ffa8013a4b441c6e4cd599a47b2b30b4cadf7c70a973ec951d3c88d66da
                                                                                                                  • Instruction Fuzzy Hash: 03A12270E10228DBDF14EFA9C940BAEBBB2BF89305F11C469D548A7340EB345986CF50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 105c3eb64927c9c46faae005668128e88051915c5f1a38475da72e084de72561
                                                                                                                  • Instruction ID: 4fce0d1cb3d355a6c8b663fd6c646b83eb9f0c46f577888148ebcfd2105b4dd4
                                                                                                                  • Opcode Fuzzy Hash: 105c3eb64927c9c46faae005668128e88051915c5f1a38475da72e084de72561
                                                                                                                  • Instruction Fuzzy Hash: B5812570E10228DBDF14EFA9C9407AEBBB6BF89305F15C4A9D548A7341EB345A86CF50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 94f20a99ea37f12e9b3bdb019516d62371ae988fdd050a11f8f75888325f34aa
                                                                                                                  • Instruction ID: 5d51568a97e194cefc452c49328656add4cec68bb6bd3004dd202ef23a08ae42
                                                                                                                  • Opcode Fuzzy Hash: 94f20a99ea37f12e9b3bdb019516d62371ae988fdd050a11f8f75888325f34aa
                                                                                                                  • Instruction Fuzzy Hash: 79513870E056198FCB08DFAAE9405AEFBF2BF89312F24C46AD449B7254D7388941CB64
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1f667e327c7e4c44e14a7e6e8a9abd75f23ff12a31e702055231ec96ce839bc2
                                                                                                                  • Instruction ID: 30de0f77e3d13a64d6f9b99a091eda31571e5cd4bbc148049934bd63b6d60ace
                                                                                                                  • Opcode Fuzzy Hash: 1f667e327c7e4c44e14a7e6e8a9abd75f23ff12a31e702055231ec96ce839bc2
                                                                                                                  • Instruction Fuzzy Hash: 72312870E05218DFDB14EFA9D448BEDBBF4AF0A30AF24592AE415B3280C7785985CF54
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f45d25bdbb40ca5c905589a44f6ff6d000cad931f41dc4c97cf5680587c8693a
                                                                                                                  • Instruction ID: a2fbe60a96fd4c7e9262688827764bad83e890617a46394754aeb1818e7f52da
                                                                                                                  • Opcode Fuzzy Hash: f45d25bdbb40ca5c905589a44f6ff6d000cad931f41dc4c97cf5680587c8693a
                                                                                                                  • Instruction Fuzzy Hash: D43126B1E046588BDB58CFABE9443DEFBB6EFC9310F14C06AD508AA254DB350949CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 01036B10
                                                                                                                  • GetCurrentThread.KERNEL32 ref: 01036B4D
                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 01036B8A
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 01036BE3
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: Current$ProcessThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2063062207-0
                                                                                                                  • Opcode ID: 2e56bc8bf4399cc5d269b6663eda8521cf69fa187c1dd828a5ab18dce05a4383
                                                                                                                  • Instruction ID: 77a3937d20369126350ab3c345022cd23d5cc569ea438f57e049b6638a08652f
                                                                                                                  • Opcode Fuzzy Hash: 2e56bc8bf4399cc5d269b6663eda8521cf69fa187c1dd828a5ab18dce05a4383
                                                                                                                  • Instruction Fuzzy Hash: 2C5164B49042499FEB14CFA9D948BEEBBF0AF88314F20846AE059A3350D7356985CF65
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 01036B10
                                                                                                                  • GetCurrentThread.KERNEL32 ref: 01036B4D
                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 01036B8A
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 01036BE3
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: Current$ProcessThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2063062207-0
                                                                                                                  • Opcode ID: 691482327b85b5e94ae71cf3b5473d657ee8cc0a8fd9a378955665f0aba28b5f
                                                                                                                  • Instruction ID: 02e59b3583e2aacc5642c691a9d305e79feac6881c6c84acb28b5bae0ae42d86
                                                                                                                  • Opcode Fuzzy Hash: 691482327b85b5e94ae71cf3b5473d657ee8cc0a8fd9a378955665f0aba28b5f
                                                                                                                  • Instruction Fuzzy Hash: A45166B4904249DFDB14CFAAD548BEEBBF4EF88314F208469E019A7350D7356984CF65
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: c5G/$c5G/
                                                                                                                  • API String ID: 0-302455307
                                                                                                                  • Opcode ID: 816bdcdefae0a47a8d01b1abcd2fcb4a2187d3065d57dfd78b8508fcc55a9291
                                                                                                                  • Instruction ID: 922343ba35e18933736e27fb13c08a019caec8589bcfcd840b6ef6eea03ac1f3
                                                                                                                  • Opcode Fuzzy Hash: 816bdcdefae0a47a8d01b1abcd2fcb4a2187d3065d57dfd78b8508fcc55a9291
                                                                                                                  • Instruction Fuzzy Hash: 16316D70D0A209DFDB04DFAAC5815AEFBF1BF89205F24C8AAC445A7255E3748B419B90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 089074EE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateProcess
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 963392458-0
                                                                                                                  • Opcode ID: 09de41b9769dc11186fea31065fea1ab5d7bcac4c2c1ddef86d0d27231c09f82
                                                                                                                  • Instruction ID: dbe1f4b8d77fa0bf5442d820a9aa2e7d4af8f546db3a8603be579381c17e6125
                                                                                                                  • Opcode Fuzzy Hash: 09de41b9769dc11186fea31065fea1ab5d7bcac4c2c1ddef86d0d27231c09f82
                                                                                                                  • Instruction Fuzzy Hash: 16B1BF71D00219DFDF20DFA8D841BEDBBB2BF48328F148569D858A7280DB75A985CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 089074EE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateProcess
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 963392458-0
                                                                                                                  • Opcode ID: 77d4093663ea55669095abf7866445cf6556520a20c8b9d231ca1b17b11bd791
                                                                                                                  • Instruction ID: dd03db76d8a4f82d22b5215acfd163161dfee64514125562a7f0f550f7031e20
                                                                                                                  • Opcode Fuzzy Hash: 77d4093663ea55669095abf7866445cf6556520a20c8b9d231ca1b17b11bd791
                                                                                                                  • Instruction Fuzzy Hash: CD919F71D00219DFDF20DFA8C881BEDBBB2BF48318F148569D858A7280DB75A985CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • GetModuleHandleW.KERNELBASE(00000000), ref: 0103BD2E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: HandleModule
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4139908857-0
                                                                                                                  • Opcode ID: 4c7ab5f031e3fa35ed00f0a88467bff1c81f212459ba14e6638de6a63d5e48c3
                                                                                                                  • Instruction ID: 7c23e02f4abeb4e710fed7129e38ba2afb8c87187df7fe8212ea8403a5efb938
                                                                                                                  • Opcode Fuzzy Hash: 4c7ab5f031e3fa35ed00f0a88467bff1c81f212459ba14e6638de6a63d5e48c3
                                                                                                                  • Instruction Fuzzy Hash: 24815770A00B059FD764DF2AD45179ABBF5FF88208F00892DD48AD7A50DB74E846CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0103DCAA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 716092398-0
                                                                                                                  • Opcode ID: 0c2714e1f040b65b070b7ec4b41fa1d96402f8a5b6b0bf193455c1cd3ce8f4c7
                                                                                                                  • Instruction ID: 1db75f25a2edbf9637a92ea69f76ae75fd98149e57348eae2f92695cff088683
                                                                                                                  • Opcode Fuzzy Hash: 0c2714e1f040b65b070b7ec4b41fa1d96402f8a5b6b0bf193455c1cd3ce8f4c7
                                                                                                                  • Instruction Fuzzy Hash: 2951B0B1D10309DFDB14CFE9D884ADEBBB5BF88310F64852AE819AB210D7749945CF90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0103DCAA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 716092398-0
                                                                                                                  • Opcode ID: 3b997f26fd522049df7de7c5e0eb65f07f9401ecfccad38b689f4f0756049f5f
                                                                                                                  • Instruction ID: 6b874b9414084cd573e5d2f83807f1052862ea7b44eaae813cac471c51732937
                                                                                                                  • Opcode Fuzzy Hash: 3b997f26fd522049df7de7c5e0eb65f07f9401ecfccad38b689f4f0756049f5f
                                                                                                                  • Instruction Fuzzy Hash: 4C41AFB1D103099FDF14CFAAC884ADEBBF5BF88314F64852AE819AB210D7749945CF90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 089070C0
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: MemoryProcessWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3559483778-0
                                                                                                                  • Opcode ID: 5714cea5325fb3fbd7791666a46e4c566e100c63cc88bff688b7626ade38fbba
                                                                                                                  • Instruction ID: 678263c306d440e33147bb6b83ea42af30f2699873ae26ae122e7c8ea127c1a8
                                                                                                                  • Opcode Fuzzy Hash: 5714cea5325fb3fbd7791666a46e4c566e100c63cc88bff688b7626ade38fbba
                                                                                                                  • Instruction Fuzzy Hash: 822124719003599FCB10DFA9C884BEEBBF4FB48324F14842AE959A7240D779A954CFA0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 089071A0
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: MemoryProcessRead
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1726664587-0
                                                                                                                  • Opcode ID: f647972c02f6671e24a015fc24142fed35a9a588722849ca85f7f05b65b34150
                                                                                                                  • Instruction ID: 9fb7cb078823b7b86d7f73529f9acf6eb953bfa1e0835223bcedbc8272f1eb52
                                                                                                                  • Opcode Fuzzy Hash: f647972c02f6671e24a015fc24142fed35a9a588722849ca85f7f05b65b34150
                                                                                                                  • Instruction Fuzzy Hash: F02127719002499FCB10DFAAC841AEEBBF5FF48324F14842AE518A7250D779AA54CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • SetThreadContext.KERNELBASE(?,00000000), ref: 08906886
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ContextThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1591575202-0
                                                                                                                  • Opcode ID: 25a3f4d20108d3bb459e533897071d1f61e242f88aef51ec51396e89a53ee3b0
                                                                                                                  • Instruction ID: 789344e0111d07b08969305fe15daef73f72677fefad7394b0dabb2918b982a6
                                                                                                                  • Opcode Fuzzy Hash: 25a3f4d20108d3bb459e533897071d1f61e242f88aef51ec51396e89a53ee3b0
                                                                                                                  • Instruction Fuzzy Hash: AB215971D003098FCB10DFAAC4857EEBBF4EF58324F14842AD918A7640DB78AA55CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 089070C0
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: MemoryProcessWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3559483778-0
                                                                                                                  • Opcode ID: 704be112aa3d262a5cc3a033fe8cbe091a706f176121c6d3aaef5e25aa340c5e
                                                                                                                  • Instruction ID: fdcce748fc4a38a3ef0ad174b72247a5b458360e049b99593b6e589f8bdd726f
                                                                                                                  • Opcode Fuzzy Hash: 704be112aa3d262a5cc3a033fe8cbe091a706f176121c6d3aaef5e25aa340c5e
                                                                                                                  • Instruction Fuzzy Hash: B02113719003599FCB10DFA9C881BEEBBF5FB48324F10842AE959A7250D779A954CFA0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • SetThreadContext.KERNELBASE(?,00000000), ref: 08906886
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ContextThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1591575202-0
                                                                                                                  • Opcode ID: 7f1d099c3aee60d56a21a39033003c74b8d8ecce44cad18a51d7c6bf6376c967
                                                                                                                  • Instruction ID: 17688fa4473ba12b1285aef24c6a56fba0d8a717d3d80dd4f715746ebc83e7c0
                                                                                                                  • Opcode Fuzzy Hash: 7f1d099c3aee60d56a21a39033003c74b8d8ecce44cad18a51d7c6bf6376c967
                                                                                                                  • Instruction Fuzzy Hash: 7D213571D003098FDB10DFAAC4857EEBBF4EF58324F14842AD919A7240DB78A945CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 089071A0
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: MemoryProcessRead
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1726664587-0
                                                                                                                  • Opcode ID: f6781236543c0118a2593a596bb52044deee1ae45d3966d270b4a126f950d840
                                                                                                                  • Instruction ID: 73265a01db1a341cebc2a34b1c4b49593905af120e9c24bffbbadebd323ef8b5
                                                                                                                  • Opcode Fuzzy Hash: f6781236543c0118a2593a596bb52044deee1ae45d3966d270b4a126f950d840
                                                                                                                  • Instruction Fuzzy Hash: 552116719002599FCB10DFAAC880AEEBBF5FF48324F108429E518A7250C779A944CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01036D5F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: DuplicateHandle
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3793708945-0
                                                                                                                  • Opcode ID: e8116529e74be6cdadf1a04099b2ac78e0914b4d666c25fc187d1fb998059d1b
                                                                                                                  • Instruction ID: 0ec0ceefbcfd662e81a08dced6e578f17e4094f7ea0837c8282d9f216c95c45f
                                                                                                                  • Opcode Fuzzy Hash: e8116529e74be6cdadf1a04099b2ac78e0914b4d666c25fc187d1fb998059d1b
                                                                                                                  • Instruction Fuzzy Hash: AC21E3B5D00249AFDB10CFA9D884ADEBBF8EB48320F14841AE954A7310D774AA44CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01036D5F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: DuplicateHandle
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3793708945-0
                                                                                                                  • Opcode ID: 0ea3f8132605758425f9bf5e6085eb30300117ef564865680431deae84bf9f3f
                                                                                                                  • Instruction ID: 11dc6779c77a5fbabc4ab106f30603be5e405f15e3f8ec2ffc5a16d6c3ab0991
                                                                                                                  • Opcode Fuzzy Hash: 0ea3f8132605758425f9bf5e6085eb30300117ef564865680431deae84bf9f3f
                                                                                                                  • Instruction Fuzzy Hash: 9321D5B5D00249AFDB10CFA9D884ADEBFF8FB48324F14841AE954A7310D774AA54CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • VirtualProtect.KERNELBASE(?,?,?,?), ref: 089028CB
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ProtectVirtual
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 544645111-0
                                                                                                                  • Opcode ID: 796265c4adc739aa2e0ffae58e17ae96e128cb20ed68e03111082e7147910223
                                                                                                                  • Instruction ID: d16fd6afc02c7a56409e1bfa9b8235d1fa67e2bff3d3991257f3f8e82a037758
                                                                                                                  • Opcode Fuzzy Hash: 796265c4adc739aa2e0ffae58e17ae96e128cb20ed68e03111082e7147910223
                                                                                                                  • Instruction Fuzzy Hash: FF2106B5D002499FDB10CF9AD884BDEFBF4FB58324F14842AE858A7240D379A945CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • VirtualProtect.KERNELBASE(?,?,?,?), ref: 089028CB
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ProtectVirtual
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 544645111-0
                                                                                                                  • Opcode ID: 0fdb475161541de09a61d5de0d7f995ba0f4f038ec604cef64c4253bf706514d
                                                                                                                  • Instruction ID: 271d01526446013e9967a2448431984f287d9a6c2974772dd9b3d32fad3f1026
                                                                                                                  • Opcode Fuzzy Hash: 0fdb475161541de09a61d5de0d7f995ba0f4f038ec604cef64c4253bf706514d
                                                                                                                  • Instruction Fuzzy Hash: F621E7B59042499FDB10DF9AC884BDEFBF4FB48324F148429E958A7250D378A944DFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0103BDA9,00000800,00000000,00000000), ref: 0103BFBA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: LibraryLoad
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1029625771-0
                                                                                                                  • Opcode ID: d6ef19c6fe29b4de525879152ef6d5a264b5d08ba46b7049492c655574c3f1a8
                                                                                                                  • Instruction ID: ebe50d294fa88c8efb545d6a81bad59f2efeaab2511ea0cf344003466946c373
                                                                                                                  • Opcode Fuzzy Hash: d6ef19c6fe29b4de525879152ef6d5a264b5d08ba46b7049492c655574c3f1a8
                                                                                                                  • Instruction Fuzzy Hash: DF1114B69042099FDB10CF9AD844BDEFBF8EB88324F04842EE559B7600C375A945CFA5
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ResumeThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 947044025-0
                                                                                                                  • Opcode ID: f7e6ae50af13d57eacf2f9a4af84356ae0a65aaf3ee91ee89bc9f6a48fea6f71
                                                                                                                  • Instruction ID: 03d7946d06e974ba0a1cd850a1b086a667e6354deb179cf06196d938ef7a36c6
                                                                                                                  • Opcode Fuzzy Hash: f7e6ae50af13d57eacf2f9a4af84356ae0a65aaf3ee91ee89bc9f6a48fea6f71
                                                                                                                  • Instruction Fuzzy Hash: 7D118BB18003498FCB10DFAAC4447EEFBF4AF88324F14881AD515B7640CB78A944CFA5
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0103BDA9,00000800,00000000,00000000), ref: 0103BFBA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: LibraryLoad
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1029625771-0
                                                                                                                  • Opcode ID: 21496f8f30928baaba7a2e63f93b063c3c487df2fb1b2e0e085777c1ca2c06a5
                                                                                                                  • Instruction ID: e5fffa1e6e0431686b0a07d5973489ecdb81d8113ff613ad03858efd6987adf6
                                                                                                                  • Opcode Fuzzy Hash: 21496f8f30928baaba7a2e63f93b063c3c487df2fb1b2e0e085777c1ca2c06a5
                                                                                                                  • Instruction Fuzzy Hash: 161114B69002499FDB10CFAAD444BDEFBF4EB88324F14842EE555A7600C379A545CFA5
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: ResumeThread
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 947044025-0
                                                                                                                  • Opcode ID: 78690b06c77e8f08250d9b01c5f362a0ae3ad6d4be19d07167e7601443bd423d
                                                                                                                  • Instruction ID: 01a4112fd867fa74126bacce2e777ed306ee5c9997f75f82a89e2dab40951ab4
                                                                                                                  • Opcode Fuzzy Hash: 78690b06c77e8f08250d9b01c5f362a0ae3ad6d4be19d07167e7601443bd423d
                                                                                                                  • Instruction Fuzzy Hash: B51166B19003488FCB10DFAAC4447EEFBF4AB88224F148829C529A7640CB78A944CFA0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • GetModuleHandleW.KERNELBASE(00000000), ref: 0103BD2E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: HandleModule
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4139908857-0
                                                                                                                  • Opcode ID: edaf2635f9d1898dada16e62e1726e43f85009dd51ddabffa9f7116c5f2ca2f9
                                                                                                                  • Instruction ID: dcd3ad919821d6519e2681071cf106e69ac6181f368bbc59475c017f42ea56a3
                                                                                                                  • Opcode Fuzzy Hash: edaf2635f9d1898dada16e62e1726e43f85009dd51ddabffa9f7116c5f2ca2f9
                                                                                                                  • Instruction Fuzzy Hash: 5711E0B6C002498FDB10DF9AD444BDEFBF8EB88224F14846AD469A7600D778A545CFA2
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • SetWindowLongW.USER32(?,?,?), ref: 0103DE3D
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: LongWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1378638983-0
                                                                                                                  • Opcode ID: 9806a304dde6e4a93515ce7d392a24c0b5f2f0e31fa4ae93a091e658432512c4
                                                                                                                  • Instruction ID: 2accd57d37060f4184d89c97561101413ad9585469d3fe18307da85ba854dd77
                                                                                                                  • Opcode Fuzzy Hash: 9806a304dde6e4a93515ce7d392a24c0b5f2f0e31fa4ae93a091e658432512c4
                                                                                                                  • Instruction Fuzzy Hash: 171115B5800249DFDB20DF99D485BDEBBF8EB98324F14841AD955B7340C374A944CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • PostMessageW.USER32(?,?,?,?), ref: 0890B175
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: MessagePost
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 410705778-0
                                                                                                                  • Opcode ID: 67e4c8c9d11f080b1cdac66a7b3fb4e0422f822a61f835f37188744e1232a81d
                                                                                                                  • Instruction ID: 3d323b87be9bc0bf538d44f9d69e7d28e908596114aaa8592dfe7ed4b5fab11b
                                                                                                                  • Opcode Fuzzy Hash: 67e4c8c9d11f080b1cdac66a7b3fb4e0422f822a61f835f37188744e1232a81d
                                                                                                                  • Instruction Fuzzy Hash: 9811E2B6900349DFDB10DF9AD885BDEBBF8FB58324F14881AE514A7640C375A984CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • SetWindowLongW.USER32(?,?,?), ref: 0103DE3D
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: LongWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1378638983-0
                                                                                                                  • Opcode ID: fa29b53f47d0f6333e1673b719c6accbf7f8a5c81a9dc4d3bf078b796ea41673
                                                                                                                  • Instruction ID: 4d890187eed92d7515a50f2c5f8a8525a9d9d36f0c5c5860193314ac61586059
                                                                                                                  • Opcode Fuzzy Hash: fa29b53f47d0f6333e1673b719c6accbf7f8a5c81a9dc4d3bf078b796ea41673
                                                                                                                  • Instruction Fuzzy Hash: 5B11E2B58002499FDB10DF9AD485BDEBBF8EB98324F14845AD955A7700C374A944CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08906FDE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: AllocVirtual
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4275171209-0
                                                                                                                  • Opcode ID: 45e680b2fbcdad3c00d8961a8c3af7c4e8b7cca56357946b27d6ae6ba6f5e7e2
                                                                                                                  • Instruction ID: 50de27ce00a48d04863fe86f3f882083ee975444809bbfbbcbfbd85caeae11ca
                                                                                                                  • Opcode Fuzzy Hash: 45e680b2fbcdad3c00d8961a8c3af7c4e8b7cca56357946b27d6ae6ba6f5e7e2
                                                                                                                  • Instruction Fuzzy Hash: 4E014C31904249CFCF10DFA9C8447EEBBF1AF98318F148429E625A7260CB799554CF90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: /;w1
                                                                                                                  • API String ID: 0-3230369038
                                                                                                                  • Opcode ID: 53efbe15b8f597e7d4f79d25c78f0c7996e3fa290697529d18475d634d3b8e7d
                                                                                                                  • Instruction ID: f4ba6a9605b58bc14ac203a9b14383af97e2b9f444652fed5235ab7623e3daaf
                                                                                                                  • Opcode Fuzzy Hash: 53efbe15b8f597e7d4f79d25c78f0c7996e3fa290697529d18475d634d3b8e7d
                                                                                                                  • Instruction Fuzzy Hash: 2CE0B634917254CFC754CF64E5488A8B7B2FF49351F105499E4069B264CB39DA81CE00
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3a7d0895cd65ce77854a73ab0f8789487c36352f102706ad018212ee5f65ef42
                                                                                                                  • Instruction ID: 5ad1b439032f3fb80a396f3d00d0276cb52f6f5cd6fe7c19f1b52542b9d7c0da
                                                                                                                  • Opcode Fuzzy Hash: 3a7d0895cd65ce77854a73ab0f8789487c36352f102706ad018212ee5f65ef42
                                                                                                                  • Instruction Fuzzy Hash: 9A513531B042058FCF14EBBCC4556AEBBF6AF8A209B15457EC996B7381DF359C028791
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b3aa1af4095878596f841da63bbe00ebcd263ca18d94ce44579f0e1b5a5e59d6
                                                                                                                  • Instruction ID: 4c4803118deceeaee98f1f5ffc7086913d973e8efce59b00f3486e9d71dbbd45
                                                                                                                  • Opcode Fuzzy Hash: b3aa1af4095878596f841da63bbe00ebcd263ca18d94ce44579f0e1b5a5e59d6
                                                                                                                  • Instruction Fuzzy Hash: B341D235B002158FCB05EFB8D8444BEBBFAEFC4224715852AE429DB391EF309C0687A1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1c88e97b363b58bc4ff9fb1261efd9a6f5e1218896506c8cbc1a78ecf8f5c1ab
                                                                                                                  • Instruction ID: 468b0070f202e85972fc0d5647cd46e297cfecb3e8c23816ff9c66eedc8291ff
                                                                                                                  • Opcode Fuzzy Hash: 1c88e97b363b58bc4ff9fb1261efd9a6f5e1218896506c8cbc1a78ecf8f5c1ab
                                                                                                                  • Instruction Fuzzy Hash: 83510470E04219CFDF05EFAAD4896AEBBF6BF89305F108429D44AAB380DB345946CF50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: bcd9ad3afa746b98745e5cb8cb0882637d99f4b8e1b7723832a348c86c9b9925
                                                                                                                  • Instruction ID: 0273f48829b9928a117e56fdec6d1f767ba56eddaf36fca4414fde9ad000a25d
                                                                                                                  • Opcode Fuzzy Hash: bcd9ad3afa746b98745e5cb8cb0882637d99f4b8e1b7723832a348c86c9b9925
                                                                                                                  • Instruction Fuzzy Hash: B031282180F3D66FCB03A77868204D97FB15E17219B1A09D7C4D1CF5E3D229498DC7A6
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f505bf32768f3cfbe3f167a58e3790ed4f4b959bc081dec9d27bff5fbfea13c2
                                                                                                                  • Instruction ID: e58b542756b30f8f5b5ae1e5c8075c81da99d62daf03e958337495a52e88c500
                                                                                                                  • Opcode Fuzzy Hash: f505bf32768f3cfbe3f167a58e3790ed4f4b959bc081dec9d27bff5fbfea13c2
                                                                                                                  • Instruction Fuzzy Hash: 8F4124B4E05219DFCB44CFA9D5819AEFBF2FB89310F10956AD814A7714E378AA41CF60
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 787dbfba912da56ec64b0153f3412a4650c29aed031db3f564b20fca893ef503
                                                                                                                  • Instruction ID: 776f654db1378d843af898253321067e0325d83ac277b3bf554dcae83c12f42a
                                                                                                                  • Opcode Fuzzy Hash: 787dbfba912da56ec64b0153f3412a4650c29aed031db3f564b20fca893ef503
                                                                                                                  • Instruction Fuzzy Hash: BF3104B4E05219DFCB44DFA9D5809AEFBF2FB88310F10956AD819A7714D378AA01CF50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5128919a52e1f9a766d641cb578ea068a6590546f9845cd18648cd8187a33790
                                                                                                                  • Instruction ID: 48a9490b6110624c4555df254f3447f749aea6ba05ad5b7df286a5e0a570d5fa
                                                                                                                  • Opcode Fuzzy Hash: 5128919a52e1f9a766d641cb578ea068a6590546f9845cd18648cd8187a33790
                                                                                                                  • Instruction Fuzzy Hash: 86313A70E05219DFCB04DFAAD58159EBBF2EF88311F15C9AAC458A7315E3389A41CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673560685.0000000000FCD000.00000040.00000001.sdmp, Offset: 00FCD000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0a76f5c3e21df39cc68a28fed1443ad9bde7a07c7bcb5a5ed55ff1cc17be347f
                                                                                                                  • Instruction ID: 8e8ef8d9ab4c48e6ea1bbd96120928346295466b90c4c221e51f9711b07de3db
                                                                                                                  • Opcode Fuzzy Hash: 0a76f5c3e21df39cc68a28fed1443ad9bde7a07c7bcb5a5ed55ff1cc17be347f
                                                                                                                  • Instruction Fuzzy Hash: 1321F571648241EFCB14CF18DAC5F2ABB65FB88324F24C57DD80A4B24AC736D847DA62
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673560685.0000000000FCD000.00000040.00000001.sdmp, Offset: 00FCD000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3f68333bd4d2ac4d4a56ee053826b8cb96fc27fb2d6d23e24aa57ea6d82a23f9
                                                                                                                  • Instruction ID: 612569119e750eecddccd378c07cc532e216fdce692023345543ecb8dab5ff58
                                                                                                                  • Opcode Fuzzy Hash: 3f68333bd4d2ac4d4a56ee053826b8cb96fc27fb2d6d23e24aa57ea6d82a23f9
                                                                                                                  • Instruction Fuzzy Hash: 112107B1904245EFDB05DF10DAC1F6ABB65FB88324F24C57DD8094B246C736D846DA61
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 142a3f3488fcf1b6dfc5ef66523e6bccd4f55324fb397eebc91376ca3bc28202
                                                                                                                  • Instruction ID: e202e8e0933285b8761a3efbb32b12346274a723ff2ebff70f42a49f8f34ee82
                                                                                                                  • Opcode Fuzzy Hash: 142a3f3488fcf1b6dfc5ef66523e6bccd4f55324fb397eebc91376ca3bc28202
                                                                                                                  • Instruction Fuzzy Hash: 0231BFB0D05218DFDB21DFA9C589B8EBBF4AB48314F24841AE408BB650D7B55945CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: bcceef049e874e8fe31453df7aaf11e6bd88bfe6ce186cc5365e371d67b577b8
                                                                                                                  • Instruction ID: 9e7a36ca7881f3d428f5aefb0445aaad1ac689fbec0733507773811b51fe2ba6
                                                                                                                  • Opcode Fuzzy Hash: bcceef049e874e8fe31453df7aaf11e6bd88bfe6ce186cc5365e371d67b577b8
                                                                                                                  • Instruction Fuzzy Hash: C521BFB0D05218DFDF21DF99C985B8EBFF4AB48718F24841AE404BB250D7B95945CFA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 86ec3b3b914d8815674995af414da7bd145b3b70d7d36eee1d3d88f643ccfa4f
                                                                                                                  • Instruction ID: 09ab9a017fd9ed5ea97f74937b89f5d9fa5c6bcc238a7929cf233b8ed7cbeca9
                                                                                                                  • Opcode Fuzzy Hash: 86ec3b3b914d8815674995af414da7bd145b3b70d7d36eee1d3d88f643ccfa4f
                                                                                                                  • Instruction Fuzzy Hash: 67218C34E05209DFCB44DFA9C584A9DFFF2EF88200F28C4AAD80897356D734AA50CB41
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673560685.0000000000FCD000.00000040.00000001.sdmp, Offset: 00FCD000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 4e4b60c5463dd3a2a224188ff967aa33518cf4070b9669f21ce2085ab9669b98
                                                                                                                  • Instruction ID: 0bdd85e4112cae8347d14204299a11fbf7f79f57a2164133f8d55f133eb0c659
                                                                                                                  • Opcode Fuzzy Hash: 4e4b60c5463dd3a2a224188ff967aa33518cf4070b9669f21ce2085ab9669b98
                                                                                                                  • Instruction Fuzzy Hash: B92180755493C08FCB02CF24D994B15BF71EB46324F28C5EED8498B697C33A980ACB62
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: abaeea2029d52458a40b9cdfc64921d89e575442762630bb20d9209242bede0c
                                                                                                                  • Instruction ID: aa6d82cdf677d2b952389af3f5646d23532426b9c3a6b700040e73000d071e73
                                                                                                                  • Opcode Fuzzy Hash: abaeea2029d52458a40b9cdfc64921d89e575442762630bb20d9209242bede0c
                                                                                                                  • Instruction Fuzzy Hash: D41106B6E006158BCF15EB7D9D452BFB6FAFFC4260B14452DE458D3340EF3089014261
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1f9a845a48330c49e55c97a72469a9e1af7f67a67e52fb0c20821e1d2faee11f
                                                                                                                  • Instruction ID: ff7ca8c76c40482db117dd684805405a2d45a993508df04e4039e9ff75b2fc08
                                                                                                                  • Opcode Fuzzy Hash: 1f9a845a48330c49e55c97a72469a9e1af7f67a67e52fb0c20821e1d2faee11f
                                                                                                                  • Instruction Fuzzy Hash: CD114832B0021A8B8F55EBBD98116EEB7B6AFC8255B10403EC545EB241EF35CD12CBE1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9963703f3f5c8574818cf806247eb2e1b9c21920ffb97338eb5f3cd706bf104f
                                                                                                                  • Instruction ID: 37586c23387f7c5a5f5026986ae3489ee9d27f4c021f5bb68b5dc9f685f4d8a7
                                                                                                                  • Opcode Fuzzy Hash: 9963703f3f5c8574818cf806247eb2e1b9c21920ffb97338eb5f3cd706bf104f
                                                                                                                  • Instruction Fuzzy Hash: F9110734E01218EFCB44DFA9C684A9DFBF2EF88304F25C4A9D919A7355E734AA11CB41
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673560685.0000000000FCD000.00000040.00000001.sdmp, Offset: 00FCD000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7d36124553d90c539148c45a8a93ecca56ad8a74831c1bc612bfc5b4ddcdf7be
                                                                                                                  • Instruction ID: 387e9f98c59ff999d1fc14aa15c02e8e5900b2a48ef319c7f2a2b55806b881bf
                                                                                                                  • Opcode Fuzzy Hash: 7d36124553d90c539148c45a8a93ecca56ad8a74831c1bc612bfc5b4ddcdf7be
                                                                                                                  • Instruction Fuzzy Hash: 48119075904280DFCB15CF10DAC4B59FB71FB84324F24C6AED8494B656C33AD84ADB52
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0c6fc021d1ce499f6eccded598a09339c82c7f7664a1206e3eb861409ea10a01
                                                                                                                  • Instruction ID: 8cd567aa0b1b6f5060ec9e633ea2249adfbe1437c5ac24e32194356d703a4b40
                                                                                                                  • Opcode Fuzzy Hash: 0c6fc021d1ce499f6eccded598a09339c82c7f7664a1206e3eb861409ea10a01
                                                                                                                  • Instruction Fuzzy Hash: 0E014B36E0021A8B8F56FFBDA9414EEBBB5EF88315B50003AC544E2200EB359912CBA1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 63f9ef1f1f0f2ca1d8a6f1904f63a71b65c177cac6ec5821bc4e7b942bd55f44
                                                                                                                  • Instruction ID: a3c1683ca93b33c50a7e245e5b929ff4c9b78a1a8dd4614740b617b144238fe4
                                                                                                                  • Opcode Fuzzy Hash: 63f9ef1f1f0f2ca1d8a6f1904f63a71b65c177cac6ec5821bc4e7b942bd55f44
                                                                                                                  • Instruction Fuzzy Hash: 84F0C2327000568BCF1AFBBCD5519AD73B7AFD4255B11403AC1449B225DF35DC12CB91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ce5229e2487e7c277fe26eab8bc6fd6f04ce0353bb6722e2c4ceb6b244dc350e
                                                                                                                  • Instruction ID: 10f6afbf9282c058cbba24b11384857e1a7add14d611c7445cba92daf3ea26c6
                                                                                                                  • Opcode Fuzzy Hash: ce5229e2487e7c277fe26eab8bc6fd6f04ce0353bb6722e2c4ceb6b244dc350e
                                                                                                                  • Instruction Fuzzy Hash: 0E011A71800219DFDF22DFADC5053AE7AF1FF44315F24862AE824AA2A0C7744A54CF80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0f64c5772141882eda2b3f422b0d8b69832bac9b4f902f80d4ee4484123952c5
                                                                                                                  • Instruction ID: db24f4c7304b05becab8cd0485657ff2e50be3b1ee0a3f2b6907ca8a7308438d
                                                                                                                  • Opcode Fuzzy Hash: 0f64c5772141882eda2b3f422b0d8b69832bac9b4f902f80d4ee4484123952c5
                                                                                                                  • Instruction Fuzzy Hash: 51F05E727042245FD304DB6ADC84E67BBE9EBCD6607558129F908C7314CA309C00C6A4
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ba810d5fd13c94cc7e739641dd4a2ef29e5e878dc9858b21d5473ef8b2156dd4
                                                                                                                  • Instruction ID: 067d5836a593d9d90d03d99e14f7b3c282f78648d8a3a906744fd8da0d9f9d1c
                                                                                                                  • Opcode Fuzzy Hash: ba810d5fd13c94cc7e739641dd4a2ef29e5e878dc9858b21d5473ef8b2156dd4
                                                                                                                  • Instruction Fuzzy Hash: DE01E870800219DFDF25DFAEC4043AEBAF5FF48355F248629E864AA290D7754A54CF90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 601883a3752dc27d6332cc7099e1c397e678e1292fc4f06466bc67910dbaedc3
                                                                                                                  • Instruction ID: e0c42c8f0929f896f0af2f1d1eec4328c236b7b1cac6e8149bdd41aab4b48356
                                                                                                                  • Opcode Fuzzy Hash: 601883a3752dc27d6332cc7099e1c397e678e1292fc4f06466bc67910dbaedc3
                                                                                                                  • Instruction Fuzzy Hash: B2E039727041246F5304DA6AD884C6BBBEEEBCD664355813AF608C7310DE309C00C6A0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: a63fb672b75b76873fed1a447881d1567b7f43f9424dff0f0ca69500b74e46b2
                                                                                                                  • Instruction ID: f7b1973d6e2af54a7d82eb4e83d0a77df4de57390a17e217d97af074e86b3486
                                                                                                                  • Opcode Fuzzy Hash: a63fb672b75b76873fed1a447881d1567b7f43f9424dff0f0ca69500b74e46b2
                                                                                                                  • Instruction Fuzzy Hash: 6201DA74A00219DFDB64EFA4D951B9DB7B2EF89204F40849AD009BB260DB349E85CF30
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 4908fadf8a38f6cf209f71f8c572c5bc0dcc4a1766d769ad7bfd7204f33faf51
                                                                                                                  • Instruction ID: 60bf32ba68d1a3d8c279ca43d95ab5796e99269b492da164647a2316a0099f8c
                                                                                                                  • Opcode Fuzzy Hash: 4908fadf8a38f6cf209f71f8c572c5bc0dcc4a1766d769ad7bfd7204f33faf51
                                                                                                                  • Instruction Fuzzy Hash: 48F0243080D386EFCB16DB78D501BD8BFB1EF07219F2445EEC4945AA92C73A4982CB81
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 839f14696e227f5d687a33d778c3f972c0b6b17e34088aa843fc2f0b614160b4
                                                                                                                  • Instruction ID: 4d05b245089e31be135d3cbf150e219c213f7812fc5cc5327ff1943207cffef8
                                                                                                                  • Opcode Fuzzy Hash: 839f14696e227f5d687a33d778c3f972c0b6b17e34088aa843fc2f0b614160b4
                                                                                                                  • Instruction Fuzzy Hash: 16E0657191610CEBC704EFFCFA4775D7FB8AB04201F114458A559A2240EA315540C791
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1a714b638dd0908206b7a69882c1fe93dd36d68f253e557b539c4ba356087434
                                                                                                                  • Instruction ID: 069954c32922cb3a5873dd1e8e1fb9ec3f1cb18260e90162a23bf30e1e0c9641
                                                                                                                  • Opcode Fuzzy Hash: 1a714b638dd0908206b7a69882c1fe93dd36d68f253e557b539c4ba356087434
                                                                                                                  • Instruction Fuzzy Hash: 22E04F32506344CFC7A1AF70F90F6957FB4EB07616B0140D2E485C3522EB3A0A58CBA2
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b9f71dca9601604689dccb945a3ab5bd77c29791b5b38acd7011818f00b826d9
                                                                                                                  • Instruction ID: db2b46bf644860d2a8fd0c09db628e0cdab99517ed77ca488e0041bde62e5ea5
                                                                                                                  • Opcode Fuzzy Hash: b9f71dca9601604689dccb945a3ab5bd77c29791b5b38acd7011818f00b826d9
                                                                                                                  • Instruction Fuzzy Hash: 39E0DF226192868ACF21DBB8D506B98BFE09B07224F040ADDC9D8AB782E7311581D282
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 64b902cc44756132c6e82059ba3691338f70ae2c2e5daa96b5bb12eacaaaa47a
                                                                                                                  • Instruction ID: 6b0427ec34cda30f4a4da5efc21c5ada7586711a1d8f5f5926e9d953e8f95bed
                                                                                                                  • Opcode Fuzzy Hash: 64b902cc44756132c6e82059ba3691338f70ae2c2e5daa96b5bb12eacaaaa47a
                                                                                                                  • Instruction Fuzzy Hash: 10E0E570D05208EFCB14EFA8D545A9DFFB9EB49305F1080ADD944A2340E7359A90DF80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: cb24c99976692c40d5126577a824ca205ef55cbc23f84646e56635f7bc5ab48c
                                                                                                                  • Instruction ID: 8c16b4873f46f8fcb3f875e4c4b5f22e16b28e1bb43ac117a237bbb920d43f16
                                                                                                                  • Opcode Fuzzy Hash: cb24c99976692c40d5126577a824ca205ef55cbc23f84646e56635f7bc5ab48c
                                                                                                                  • Instruction Fuzzy Hash: E6F0AF74A06368CFDB61CF64DA80B99BBF1BB08300F5011D5E908AB390D6399E80CE40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 18c9fac6c1c688952678a61af937f4e9acd126eca35ee64e1e4ae9868aa76085
                                                                                                                  • Instruction ID: c4b774b010c3d70186c231344a0831c585a3a612003e1b24683c412bb109f9bd
                                                                                                                  • Opcode Fuzzy Hash: 18c9fac6c1c688952678a61af937f4e9acd126eca35ee64e1e4ae9868aa76085
                                                                                                                  • Instruction Fuzzy Hash: 2AE08C3A3106109FC314DF59E909F89BBE5EF98721F058026F209DB770CA30DC018A40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 24d9d49738c5339ce8e120541de057b609f332ecf4ff3621c8efbb25e64960f2
                                                                                                                  • Instruction ID: d16638d9d6ad540b77641896a735f9bfd573c8be910cd9e6fb8ab393f0277c4e
                                                                                                                  • Opcode Fuzzy Hash: 24d9d49738c5339ce8e120541de057b609f332ecf4ff3621c8efbb25e64960f2
                                                                                                                  • Instruction Fuzzy Hash: 8AE0EC70A252089FCB54EFB8E545A9DBFB8AB06205F1045A9C948B3340FB305A408A81
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 29bb01b1642a17a40ed0b12a4a423531dc185cc0da09dd15d59b750137f19c00
                                                                                                                  • Instruction ID: dbc2e3a0e1f3957a226d8bb5c278e48969501d31583d3f3125163d73bc798601
                                                                                                                  • Opcode Fuzzy Hash: 29bb01b1642a17a40ed0b12a4a423531dc185cc0da09dd15d59b750137f19c00
                                                                                                                  • Instruction Fuzzy Hash: 03E0EC3491520CEFCB44FFFCE64AA9DBFB8AB09205F1144A9E949A3240EB315A80CB41
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f989b28dff9425a77a359b6e3d23cb94b1004e6a240f9bb6afc422b335badebe
                                                                                                                  • Instruction ID: 37a50bafd3b973736a2b4cbb6ef85591093bb4dc4c972858d10c1c41eacf000a
                                                                                                                  • Opcode Fuzzy Hash: f989b28dff9425a77a359b6e3d23cb94b1004e6a240f9bb6afc422b335badebe
                                                                                                                  • Instruction Fuzzy Hash: 8CD012363006149FC3149A4AE808D46BBE9EFC9731B158066F609C7360CA71EC01CA94
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b1d97e86ef276a557dc7b7900cf63b644d73f96f030e4f614f8e1be3f3697c82
                                                                                                                  • Instruction ID: 2662ad833f970c0ce9e24f6b966d8ffa142a8be5a9e86503fa565355c83d9f46
                                                                                                                  • Opcode Fuzzy Hash: b1d97e86ef276a557dc7b7900cf63b644d73f96f030e4f614f8e1be3f3697c82
                                                                                                                  • Instruction Fuzzy Hash: 8EE0E5B8E01768CFDB60CFA8D840B9EB7B2BF49310F118295D408A7344D330AA80CF12
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: a97b9f094e6c131da8a66c3bd422ffd12921dd7b0566f781e079e8260abb4c2a
                                                                                                                  • Instruction ID: e864ccb668ada4927636873e8a01fc9d57b915429b6f6d24d06e86801c135345
                                                                                                                  • Opcode Fuzzy Hash: a97b9f094e6c131da8a66c3bd422ffd12921dd7b0566f781e079e8260abb4c2a
                                                                                                                  • Instruction Fuzzy Hash: EED0C7315172149BC7E0AF75FA0F7597BE8EB0A217F0144A5D549C2511EF3B5444CA51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 659f7995993966ac97941396b7df043019ccb297f59a0b0f44be9834ab5eac9f
                                                                                                                  • Instruction ID: 203f45bc8d5cd89e6a33c90a4cadcb12637b30195ef872cad57bbe06f3751d79
                                                                                                                  • Opcode Fuzzy Hash: 659f7995993966ac97941396b7df043019ccb297f59a0b0f44be9834ab5eac9f
                                                                                                                  • Instruction Fuzzy Hash: 5BD05EB8D04298CFEF50CF9CD84079AF7B2FF05384F225296C08AB2204E3305A418F46
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1377df5d190b2422f4dce10592fd21972196d5159cf54c3188fb84a031f48086
                                                                                                                  • Instruction ID: 6a581b36b582f9da81ce1fa40af3c830e1f08ce39285518a2aff199465260cb6
                                                                                                                  • Opcode Fuzzy Hash: 1377df5d190b2422f4dce10592fd21972196d5159cf54c3188fb84a031f48086
                                                                                                                  • Instruction Fuzzy Hash: 48D01770E0A2288BEB64CFA9C9A06ADB7F2FF84300F14D199C119A7244E2304A48CF15
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Non-executed Functions

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: Md0$Md0
                                                                                                                  • API String ID: 0-3636340778
                                                                                                                  • Opcode ID: 1130b8f46e18da0872a334b9dbb6e5bbbc101e24eb2f9742021f87618241262e
                                                                                                                  • Instruction ID: ccb7b98f217f269d5a572e358e612533781687a011dfe686b9b88753a4b7d3c9
                                                                                                                  • Opcode Fuzzy Hash: 1130b8f46e18da0872a334b9dbb6e5bbbc101e24eb2f9742021f87618241262e
                                                                                                                  • Instruction Fuzzy Hash: C241E5B4E0560ADBCB04DFA9D5815AEFBF2FB89301F24C56AC445F7214EB345A418B94
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: tzF
                                                                                                                  • API String ID: 0-1482685216
                                                                                                                  • Opcode ID: 870ece5ff22a63ea8f9090155773dc53430b2ec5494e7721aa53f61252a1f518
                                                                                                                  • Instruction ID: edcd6de561854e88ddb6a9369b98d084153b0921f79baaec18a7e2ea22565ad8
                                                                                                                  • Opcode Fuzzy Hash: 870ece5ff22a63ea8f9090155773dc53430b2ec5494e7721aa53f61252a1f518
                                                                                                                  • Instruction Fuzzy Hash: 71B12470E092598FCB04DFA9C9815AEFBF2AF88305F14C52AD404EB358E73899429F65
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: -
                                                                                                                  • API String ID: 0-2547889144
                                                                                                                  • Opcode ID: 8066d51b0635a082ab2430b22f888cf895a6b2922dedf4feb579e4b1e29b9ea4
                                                                                                                  • Instruction ID: 2786601d85172ca8b3826e99db3ba631af17dcfcb2791084044c9795fe0d9c8c
                                                                                                                  • Opcode Fuzzy Hash: 8066d51b0635a082ab2430b22f888cf895a6b2922dedf4feb579e4b1e29b9ea4
                                                                                                                  • Instruction Fuzzy Hash: BE411F71E056588BEB5DCF6B9D4078AFAF7BFC9200F14C1BAD44CA6254DB7006858F11
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 695b7fba2ddfb4e223049e4bcec567599bcf4440f6562e5e4e5402cde3dd5b6a
                                                                                                                  • Instruction ID: d608dd3d51620789bc0e61699fe097e90c3a810c259c54fdb247669b1664727f
                                                                                                                  • Opcode Fuzzy Hash: 695b7fba2ddfb4e223049e4bcec567599bcf4440f6562e5e4e5402cde3dd5b6a
                                                                                                                  • Instruction Fuzzy Hash: F62266F554B3C667C703DB3C8099585BFA29D03028B6D19DDE8E00F0A7C9A7E18AD75A
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 48b36ab717833e26875bc4b8e5d97e0d3a502457c584d3f70b1bc597534dd411
                                                                                                                  • Instruction ID: 81a210dbbc02f28eda626aef76209a4801a0adaababc6ee6fbfee919109d609c
                                                                                                                  • Opcode Fuzzy Hash: 48b36ab717833e26875bc4b8e5d97e0d3a502457c584d3f70b1bc597534dd411
                                                                                                                  • Instruction Fuzzy Hash: 82527BB1D48702CFE798CF14E4881B97BB1FB84314BD28A29C951AB6D1D3B4656ECF84
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d39a1a2f7fe5b8c88e69e90217db4f4a7e5ce07bcea6fef0852b9750898a24fe
                                                                                                                  • Instruction ID: eabd394538308a497a2821abe2402a361751c9fc823c86afbb6bd2018c3c9efc
                                                                                                                  • Opcode Fuzzy Hash: d39a1a2f7fe5b8c88e69e90217db4f4a7e5ce07bcea6fef0852b9750898a24fe
                                                                                                                  • Instruction Fuzzy Hash: BED1CC70B042058FEB25EB79C460BAAB7EAAFC9709F14856DD046CB3D0CB75E906CB51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 2ad19d936226356a97ae373f0e89f7b0f17c9ec5b9fffb508299170b1e0ad86f
                                                                                                                  • Instruction ID: 759d4594d72ec598d8c343bf2860ca364ca34bdfd868d08181ad490d4ad981b1
                                                                                                                  • Opcode Fuzzy Hash: 2ad19d936226356a97ae373f0e89f7b0f17c9ec5b9fffb508299170b1e0ad86f
                                                                                                                  • Instruction Fuzzy Hash: 72D1D534A00509CFCB04DFA9C598AA9B7F6BF8D305F2585A9E409AB3B1DB31AD41CF50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 63d022f5affc2eda5171df5d8c4156fa980d916066c93fc54fccde322eabcf1d
                                                                                                                  • Instruction ID: ff6414eb17b287c9bc60674fd8b590599ddeda58922d6e2fa3c2cc5f6a3e6288
                                                                                                                  • Opcode Fuzzy Hash: 63d022f5affc2eda5171df5d8c4156fa980d916066c93fc54fccde322eabcf1d
                                                                                                                  • Instruction Fuzzy Hash: A4D14774E152198FCB14DFA9C980AAEFBB2FF89304F24C1AAD509AB355D7309941CF64
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7e7218451f69a4bfe2c46661a8f8c70349efea5a6a9b59ba4c5834b1e640ec2d
                                                                                                                  • Instruction ID: 0d796e9cc163f8d65ac8cb282f86b736713ce1f4562dae2106b7e5b6eb27db06
                                                                                                                  • Opcode Fuzzy Hash: 7e7218451f69a4bfe2c46661a8f8c70349efea5a6a9b59ba4c5834b1e640ec2d
                                                                                                                  • Instruction Fuzzy Hash: 35D1F431D21B5ADACB10EF64D9906DDB771FF95200F608B9AE00A37264EF706AC5CB91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ce3b469a2577b3ee6df8843cfbedf17912dbc1ae07513ee7b91b69bf060fc1da
                                                                                                                  • Instruction ID: 9c8de4e32fa6fe32b1e326de7fa75be91d5e8456c213452217500d336dade9f5
                                                                                                                  • Opcode Fuzzy Hash: ce3b469a2577b3ee6df8843cfbedf17912dbc1ae07513ee7b91b69bf060fc1da
                                                                                                                  • Instruction Fuzzy Hash: FEC12674E152198FCB14DFA9C980AAEFBF2BF89304F24C16AD509AB355D7309941CFA4
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.673703545.0000000001030000.00000040.00000001.sdmp, Offset: 01030000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 125ef7cad005694c4263c10b4c7fb84c2fb9cff90de26cb7ad301ac5aea2ee72
                                                                                                                  • Instruction ID: 22acc13e44041c809a01e49699c2a668a6ec4d2c17bea00e617f3d8b7760913b
                                                                                                                  • Opcode Fuzzy Hash: 125ef7cad005694c4263c10b4c7fb84c2fb9cff90de26cb7ad301ac5aea2ee72
                                                                                                                  • Instruction Fuzzy Hash: 95A16B32E0021ACFCF05DFA9C8445DEBBF6FFC9304B15856AE945AB221EB31A955CB50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 02aecb3d1a5d953bdd4fd788e8ca6f86910a15b4b0e7b843f47a567d612d0d5a
                                                                                                                  • Instruction ID: 9495b734f3dd4e46b4227821439205708eb8dca5f20c0fb8e3d2a2468e3b29d9
                                                                                                                  • Opcode Fuzzy Hash: 02aecb3d1a5d953bdd4fd788e8ca6f86910a15b4b0e7b843f47a567d612d0d5a
                                                                                                                  • Instruction Fuzzy Hash: 5ED1E531D21B5ADACB00EF64D9906DDB771FF95200F608B9AE00A37264EF706AC5CB91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f50cb18a9da65e4eeda63ed60a8e2d1689fb54e97022acece339eba4f4a72de1
                                                                                                                  • Instruction ID: 39e3a4c1623f2ecf4a63ba80217e640820e76edaf5d04860ef78e3e25b38a75f
                                                                                                                  • Opcode Fuzzy Hash: f50cb18a9da65e4eeda63ed60a8e2d1689fb54e97022acece339eba4f4a72de1
                                                                                                                  • Instruction Fuzzy Hash: 8CB15874E052198FCB14DFA9C980AADFBB2FF89309F24C1AAD519A7355D7309981CF60
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5f1ffd78ebb1b06bf5874115ff7d30fbb5a63e0bca4b3d96454a772fa43189f3
                                                                                                                  • Instruction ID: 763cf02e343568da8e74f5ca04b3cb7ea907147db7771793b0a19e421fa1ad98
                                                                                                                  • Opcode Fuzzy Hash: 5f1ffd78ebb1b06bf5874115ff7d30fbb5a63e0bca4b3d96454a772fa43189f3
                                                                                                                  • Instruction Fuzzy Hash: 6EB13874E152198FCB14EFA8C980AADFBF2FF89309F248159D509AB395D730A941CF64
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 276bf6a59fa9b56c6ce7b4636ebd51500fd19118cf25a65e9e9516bccdc7dee6
                                                                                                                  • Instruction ID: 7e48627085f3ac2920d46182c71018906ec6ef9918561315b9af3ec91b712332
                                                                                                                  • Opcode Fuzzy Hash: 276bf6a59fa9b56c6ce7b4636ebd51500fd19118cf25a65e9e9516bccdc7dee6
                                                                                                                  • Instruction Fuzzy Hash: 77B12874E05219CFCB14EFA8CA80AADF7B2FF89309F248159D509AB355D730A941CFA4
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: a92336f3bf793662f1ecec21f30d1649e9abfb13be7d405f38eacf3da4916b1c
                                                                                                                  • Instruction ID: a98fd9cb1ed91a7f275d8aec23b50556d56c7faff931a0cae6b0e9d398d6af9c
                                                                                                                  • Opcode Fuzzy Hash: a92336f3bf793662f1ecec21f30d1649e9abfb13be7d405f38eacf3da4916b1c
                                                                                                                  • Instruction Fuzzy Hash: AEB12674E142298FCB14DFA9C980AADFBF2BF89304F24C1AAD519A7355D7309981CF64
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8988d143237b715295ef54122a2225dbd88773e23982d7f6e9afd281143860df
                                                                                                                  • Instruction ID: ea441be57269b780e04936fe4edd49fcf5c14bb30d29dbfa70a1c4f209928cc5
                                                                                                                  • Opcode Fuzzy Hash: 8988d143237b715295ef54122a2225dbd88773e23982d7f6e9afd281143860df
                                                                                                                  • Instruction Fuzzy Hash: 0F91F574E05209CFCB48EFA9D9405EEBBF2EB89301F24942ADA15B7394DB319A418F54
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 259b6790acbe890e5d100b09e97420d8d780c02bffba3818f4d05656ae02cf88
                                                                                                                  • Instruction ID: b8a6bc10d1a1bb1281767eeda47f8dbcc478ba0d3a304989d604491aee458654
                                                                                                                  • Opcode Fuzzy Hash: 259b6790acbe890e5d100b09e97420d8d780c02bffba3818f4d05656ae02cf88
                                                                                                                  • Instruction Fuzzy Hash: 26718A70E0920ADFCB04DFE9C5416EEFBF2AB89315F14C42AD615BB294D33486418FA8
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 33cc207e03e554094d086e4e651c977e7b76a641337a654cd34d385234b25e45
                                                                                                                  • Instruction ID: b5843a6e12b62c1c416ea89e388234f42242c230549f974f9f8a405a84e7faa7
                                                                                                                  • Opcode Fuzzy Hash: 33cc207e03e554094d086e4e651c977e7b76a641337a654cd34d385234b25e45
                                                                                                                  • Instruction Fuzzy Hash: 9F615870E05669CFDB28CF6ADC4079DFAB6AFC9301F10D5AAC40DB6254E7305A868F40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 68a586b918a3cbc7be9e9394a5e57af84d6b87914a7b457a8aa88d7c3195e05f
                                                                                                                  • Instruction ID: 5c5d9ad3e5ba83a98180eea926e5a82c96f7cd886513df026ea6338d7eecb850
                                                                                                                  • Opcode Fuzzy Hash: 68a586b918a3cbc7be9e9394a5e57af84d6b87914a7b457a8aa88d7c3195e05f
                                                                                                                  • Instruction Fuzzy Hash: E9613774E16219DFCB04DF99E480AEEFBB2FB89321F14852AD555AB314C3389A41CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 2f4a0776ae3664c2ab9f660b6f77a05fc6a6baa60cb133035ff203787268a347
                                                                                                                  • Instruction ID: e07f576fdf01e8bf12430271c159091ee5a824fac705db7bbf7430bdefb5cdbf
                                                                                                                  • Opcode Fuzzy Hash: 2f4a0776ae3664c2ab9f660b6f77a05fc6a6baa60cb133035ff203787268a347
                                                                                                                  • Instruction Fuzzy Hash: 39610070E05259DFCF08CFA9D9809EEFBF2FB88211F24942AD405B7354D771AA418B54
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b72f37970655e275f67ca8ebf7228d259e6b2dd6d44d8cb7c0a4779bb031dbea
                                                                                                                  • Instruction ID: 8b45679b8f0cec576589bb598311bd7f627ad47009e80a7f8af435daa66dd431
                                                                                                                  • Opcode Fuzzy Hash: b72f37970655e275f67ca8ebf7228d259e6b2dd6d44d8cb7c0a4779bb031dbea
                                                                                                                  • Instruction Fuzzy Hash: B5613670E0426ACFDB24CF65DC40B99FBB2FB99301F1095EAD00AB6654E7345AD68F50
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 644114cb3abd352cf1ae1609bb9224cab6b0bac417258154baf76711f7f79cc7
                                                                                                                  • Instruction ID: 976ad0afdbf833d15e91ff195f0ec188abfd3627e57823de8bcfe6da4c81de41
                                                                                                                  • Opcode Fuzzy Hash: 644114cb3abd352cf1ae1609bb9224cab6b0bac417258154baf76711f7f79cc7
                                                                                                                  • Instruction Fuzzy Hash: DD513970E0566ACEDB24DF69DC40B9DFBB2BF89301F1096EAC00AB6654E7305A958F40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: a5c9dcf46dc7b1cfd783762c73adb4acdb7cb7b05980fa289f6cc6e0059febd4
                                                                                                                  • Instruction ID: 40bfc081510e817f13f5e31a06abb4a40c5e65324048c85aabbddf60909382b1
                                                                                                                  • Opcode Fuzzy Hash: a5c9dcf46dc7b1cfd783762c73adb4acdb7cb7b05980fa289f6cc6e0059febd4
                                                                                                                  • Instruction Fuzzy Hash: E7418071E056548BEB5DCF6B9C40689FFF7AFC9200F18C1FAD44CAA255DA7005868F11
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1b8b2968091d798b03742e453456970985fbbf7f88edbc641cbdf500cc1bd700
                                                                                                                  • Instruction ID: ca1556b06e7e4381b5ccf6fbd66594fe82241d881b9a99c62983fa6b95b21076
                                                                                                                  • Opcode Fuzzy Hash: 1b8b2968091d798b03742e453456970985fbbf7f88edbc641cbdf500cc1bd700
                                                                                                                  • Instruction Fuzzy Hash: E8415FB1E116198BEB68DF6B9D4479EFBF3BFC8301F14C1BA850CA6254EB341A458E11
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7239fe27ca63c6e5ff3c0b0ba829c44706011842a9bca5c44493e32009322f24
                                                                                                                  • Instruction ID: c4674a93004632eae51faee63f510de2e87ef3ee6091a733127b5359a81e1d30
                                                                                                                  • Opcode Fuzzy Hash: 7239fe27ca63c6e5ff3c0b0ba829c44706011842a9bca5c44493e32009322f24
                                                                                                                  • Instruction Fuzzy Hash: DE41B270E0420A9FDF48DFAAD5805AEFBF6FF88301F14C42AC419A7244D7745A418FA4
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684041185.0000000008990000.00000040.00000001.sdmp, Offset: 08990000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8dbe8a896d1a22e752531ab25dd5cff78442454730160c96688e9c804d224f74
                                                                                                                  • Instruction ID: d549a88adc1238871dccac4a893ad3bf6397c4c9c556a16b01106dc6d65ebdb2
                                                                                                                  • Opcode Fuzzy Hash: 8dbe8a896d1a22e752531ab25dd5cff78442454730160c96688e9c804d224f74
                                                                                                                  • Instruction Fuzzy Hash: 1831FB71E056189BEB19DFABD8406DEFBF3EFC9200F14C0BAD508A6254EB340A458F61
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8499311a3f6cee9513c7cc2051cfcdeb540150e375c84b4acefc43bcd0e4da7e
                                                                                                                  • Instruction ID: a8c8d5c8a5b139858058f119d521a8c89fb5896d33fd09a2bde1461e1e09e9aa
                                                                                                                  • Opcode Fuzzy Hash: 8499311a3f6cee9513c7cc2051cfcdeb540150e375c84b4acefc43bcd0e4da7e
                                                                                                                  • Instruction Fuzzy Hash: E821E371E116199BEB58CFABD9406AEFAF7ABC8210F14C03AD508A7254EB305A168F51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000000.00000002.684023934.0000000008900000.00000040.00000001.sdmp, Offset: 08900000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: c8cd1363779f75ce4ffae1b90b02fe428cfdf8ac7be246ff1ad13090f4e80af7
                                                                                                                  • Instruction ID: 76468bbb5b1248552a7634feb87ba1e3351939c7ebf95c579510114a92f578ea
                                                                                                                  • Opcode Fuzzy Hash: c8cd1363779f75ce4ffae1b90b02fe428cfdf8ac7be246ff1ad13090f4e80af7
                                                                                                                  • Instruction Fuzzy Hash: 16213671E156589FDB48CFABD9406AEFAF7AFC9300F18C07AD408A7255EB344A068F51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Executed Functions

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.918012198.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: InitializeThunk
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2994545307-0
                                                                                                                  • Opcode ID: dcda39a02c36738f20ee52aab09c5ac77f2e6fbb570814dd8c28b9b88c90abc1
                                                                                                                  • Instruction ID: 59b23d52d8e8f3064253e2e543c45fae313de00c5abdd4f3d2f143354921330e
                                                                                                                  • Opcode Fuzzy Hash: dcda39a02c36738f20ee52aab09c5ac77f2e6fbb570814dd8c28b9b88c90abc1
                                                                                                                  • Instruction Fuzzy Hash: 90623A31E006298FDB25EF78C85469DB7F2AF89304F1085A9D54AAB364EF349D85CF81
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: InitializeThunk
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2994545307-0
                                                                                                                  • Opcode ID: 4ad539229d9fb598c9b210ce8585df4cc606734672172ca8577ad128c6346212
                                                                                                                  • Instruction ID: f0273b0849b2845fbf9b4aca63692739dec4412ff62290b8344f1d26d3885998
                                                                                                                  • Opcode Fuzzy Hash: 4ad539229d9fb598c9b210ce8585df4cc606734672172ca8577ad128c6346212
                                                                                                                  • Instruction Fuzzy Hash: FD714E30A1020ADFDB19EFB5E4597AEBBB2AF85308F10882DE405D7369DF789845CB51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.918012198.0000000001330000.00000040.00000001.sdmp, Offset: 01330000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: InitializeThunk
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2994545307-0
                                                                                                                  • Opcode ID: ee806c20ecc965fdb421e4c5106a0582e3c176dd3ec7ae9823dd6d5b038323e1
                                                                                                                  • Instruction ID: 2af8857559191e7e534320e2b5dc39e9e64177b0174699e83df7c74538dd7417
                                                                                                                  • Opcode Fuzzy Hash: ee806c20ecc965fdb421e4c5106a0582e3c176dd3ec7ae9823dd6d5b038323e1
                                                                                                                  • Instruction Fuzzy Hash: 4151F471B002459FCB14EFB4D854AAEB7F6EF85204F10896ED5029B395EF34DC058B61
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0131DF91
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: QueryValue
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3660427363-0
                                                                                                                  • Opcode ID: 1aca68d41c91faeb8055c21fa95e05bd11993a67259df4995b916ddf33534133
                                                                                                                  • Instruction ID: 0fc416097eaa64833601e5833833e7803c808dfb558284a2141baa4ecfb23248
                                                                                                                  • Opcode Fuzzy Hash: 1aca68d41c91faeb8055c21fa95e05bd11993a67259df4995b916ddf33534133
                                                                                                                  • Instruction Fuzzy Hash: B64147B1E04258DFDB14CFEAC884A9EBBF5BF49314F15802AE818AB354D7749909CF91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0131DF91
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: QueryValue
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3660427363-0
                                                                                                                  • Opcode ID: 3ef7f04284d6b34da8fb20dd752a3a0568fbabcf901e30d1d76c1cfb97ebb285
                                                                                                                  • Instruction ID: 9f09bd1f2edb39f7ea8cfece6dc69f363de1bce158b578a5bb2d9dd9e07d3374
                                                                                                                  • Opcode Fuzzy Hash: 3ef7f04284d6b34da8fb20dd752a3a0568fbabcf901e30d1d76c1cfb97ebb285
                                                                                                                  • Instruction Fuzzy Hash: E94144B1E042489FCB14CFE9C888A9EBBF1AF49304F15806AE818AB354D7749909CF51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0131DCD4
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: Open
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 71445658-0
                                                                                                                  • Opcode ID: b9425a063e20fcd8bccf436006d5425767b23e519623ad04f398ac3a679cd1c2
                                                                                                                  • Instruction ID: a3e9ee528e3316df3558a82cc61bbd558d7dacbb4e7ac8a6f33e8a031aed384a
                                                                                                                  • Opcode Fuzzy Hash: b9425a063e20fcd8bccf436006d5425767b23e519623ad04f398ac3a679cd1c2
                                                                                                                  • Instruction Fuzzy Hash: 984147B0E052499FDB04CFA9C588A8EFFF5BF49308F29C56AD408AB345C7789845CB91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0131DF91
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: QueryValue
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3660427363-0
                                                                                                                  • Opcode ID: bff49972559f57b3c2118eece35feb86be69e601af501dbf7d71cc968545104b
                                                                                                                  • Instruction ID: 67428e59b3c7de9f057870a69bc8f47e51a2e4b5f8b41456b9983e3d65b040e0
                                                                                                                  • Opcode Fuzzy Hash: bff49972559f57b3c2118eece35feb86be69e601af501dbf7d71cc968545104b
                                                                                                                  • Instruction Fuzzy Hash: 8831E0B1D002589FCB14CFDAC888A9EBFF5BF49314F14802AE819AB314D7749909CFA0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  APIs
                                                                                                                  • RegOpenKeyExW.KERNELBASE(80000001,00000000,?,00000001,?), ref: 0131DCD4
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.917973506.0000000001310000.00000040.00000001.sdmp, Offset: 01310000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID: Open
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 71445658-0
                                                                                                                  • Opcode ID: b39c525513e00a2759f90a0a41e516778c52beed0c11680a34e85ba60fcf7b29
                                                                                                                  • Instruction ID: adf7f91bc9937b8cd85c4c9778faaf8ce4de9f3dd07ef2098ff5986d1f9803b7
                                                                                                                  • Opcode Fuzzy Hash: b39c525513e00a2759f90a0a41e516778c52beed0c11680a34e85ba60fcf7b29
                                                                                                                  • Instruction Fuzzy Hash: 943112B0D002499FDB14CFD9C588A8EFFF5BF49318F68856AE409AB314C7B59945CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.921690031.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 62f8c9c636bbb4494bcba9efd6fa670107753eeb2bc354d9716ec81143e394ce
                                                                                                                  • Instruction ID: 10d6a0b5ab4cd44315cb1d0874aa1c6761c4109b6b87b43353c1d89b47a4bd06
                                                                                                                  • Opcode Fuzzy Hash: 62f8c9c636bbb4494bcba9efd6fa670107753eeb2bc354d9716ec81143e394ce
                                                                                                                  • Instruction Fuzzy Hash: 1FA2E574A01228CFCB64DF70D89969DBBB6BB48306F2085EDD50AA3354DB399E81CF51
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.921690031.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b6a7ba65322596027bcdeb20da7f4bd11dcdde656d4dfdb9c88507b9338b30fb
                                                                                                                  • Instruction ID: 4e1415f95ed0c43c21da1d907c2f9e254f1a9bd395508824095aacb394229b2d
                                                                                                                  • Opcode Fuzzy Hash: b6a7ba65322596027bcdeb20da7f4bd11dcdde656d4dfdb9c88507b9338b30fb
                                                                                                                  • Instruction Fuzzy Hash: DFC16F75F001099FEB24DB69C494BAEB7B2FF89350F158869E806EB390DA74DC41CB91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.921690031.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 800ee9be827571ea81251dea5ac14953a24f1e207c24145d0ac25a3a483e0e6c
                                                                                                                  • Instruction ID: bec99bf51439819a1ff767d9ce2b64536c63335224a12585cee83f0550f28755
                                                                                                                  • Opcode Fuzzy Hash: 800ee9be827571ea81251dea5ac14953a24f1e207c24145d0ac25a3a483e0e6c
                                                                                                                  • Instruction Fuzzy Hash: 1EB16C75F001099FDB24DF69C4A4BAEB7B2FB89350F15886DE806EB390DA749C418B91
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000005.00000002.921690031.0000000005CE0000.00000040.00000001.sdmp, Offset: 05CE0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 40c7a2c00c6d0fd898f98951e2a769994e59c2e94cd15d679b5a1b36a3b9a007
                                                                                                                  • Instruction ID: 59fff3207197e5246657cc99eda21e74309f50edf76e6c5eab1aee32bdd5669d
                                                                                                                  • Opcode Fuzzy Hash: 40c7a2c00c6d0fd898f98951e2a769994e59c2e94cd15d679b5a1b36a3b9a007
                                                                                                                  • Instruction Fuzzy Hash: 230128327242481FD3191A7A98556BBBBAFEFC9250F54887BE906C7385DE388C4743B1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Non-executed Functions

                                                                                                                  Executed Functions

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 6cab2907d8a2ea108a155e5414866253ae6edf3d74dd34946b97feb3493a5488
                                                                                                                  • Instruction ID: 75bdef97eeb6977d6d64c48bed7cbcf48b6d73c5eff1aa3a595de07dbc0a5976
                                                                                                                  • Opcode Fuzzy Hash: 6cab2907d8a2ea108a155e5414866253ae6edf3d74dd34946b97feb3493a5488
                                                                                                                  • Instruction Fuzzy Hash: 82223C34B016129FC725EF75E4A462E77B2FB84209F248A2CC54A87399DB75ED42CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 2a0febe5adffa7970d7adf69d4232ccd9f451443745d243958da3eb0a9dea626
                                                                                                                  • Instruction ID: 00d09f09939e862727bcc20e6b9170162c623a6aaa4a1a66bdb3533f50a07999
                                                                                                                  • Opcode Fuzzy Hash: 2a0febe5adffa7970d7adf69d4232ccd9f451443745d243958da3eb0a9dea626
                                                                                                                  • Instruction Fuzzy Hash: AB3105319043859FDB26EF70E4287DE7BB2AF89318F0489A9C4416B665CB749985CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9c784e2ab3b3d126895709f3a4634beb7c151eb4053318bc59eff79d50785631
                                                                                                                  • Instruction ID: 466ecd356332f5567b3243c415bfd1170ea5777890c8a19df8dcf3f0d6d3fe0f
                                                                                                                  • Opcode Fuzzy Hash: 9c784e2ab3b3d126895709f3a4634beb7c151eb4053318bc59eff79d50785631
                                                                                                                  • Instruction Fuzzy Hash: C571A135A002469FDB29AF70D4286AEB7B3FF88318F148529D40667768DF75ED85CB40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 879fdadebcebd5f417e2d8c44ddb53b15fc27389f35f9d55af305e436a5f8fd5
                                                                                                                  • Instruction ID: d424e70749f2b80452f88edb5250b6175f0fc77aca323892e82d5957683e961e
                                                                                                                  • Opcode Fuzzy Hash: 879fdadebcebd5f417e2d8c44ddb53b15fc27389f35f9d55af305e436a5f8fd5
                                                                                                                  • Instruction Fuzzy Hash: 0431F6757106118FC759AB78C46896D37E2AF9A61D32108B8E406CF7B6DF36EC42CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b6e8bf458b5685f3b0cc8a7bc5340c98dad1a784c4c5ab8bac60c1dd3a7067f9
                                                                                                                  • Instruction ID: 4268d3fec72f9c2b58c81d024d8b42585b2a502850ae22aad692ad74fa2595ac
                                                                                                                  • Opcode Fuzzy Hash: b6e8bf458b5685f3b0cc8a7bc5340c98dad1a784c4c5ab8bac60c1dd3a7067f9
                                                                                                                  • Instruction Fuzzy Hash: 8821F3757105118FC758AB78C46892E33E2AF8961D36108B8E406CF7B5DF36EC42CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9a7528426c53b08dea3ba7dfa22479921d4837ee98412c550900fbc7ed07d76d
                                                                                                                  • Instruction ID: 032b01ffe71fdeb54ae586bf546f5ba2c29249633c1e9697e15e6bb0280a95a9
                                                                                                                  • Opcode Fuzzy Hash: 9a7528426c53b08dea3ba7dfa22479921d4837ee98412c550900fbc7ed07d76d
                                                                                                                  • Instruction Fuzzy Hash: E311E134B10118AFCB19EBB4D0607AD3BEAEF8A608F1045A8C608DB7A4DF759D068795
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 023a78a70f2ee09264ead58201a8c307f0d977db83089dd43e35a94f5e4fa8ed
                                                                                                                  • Instruction ID: 1f1e6f34da167221e597d502c183761739348d40c74806511e82898449ab8a1f
                                                                                                                  • Opcode Fuzzy Hash: 023a78a70f2ee09264ead58201a8c307f0d977db83089dd43e35a94f5e4fa8ed
                                                                                                                  • Instruction Fuzzy Hash: 3A11A575E002169FCB04DFB9D8459EEBBB5FF89200B10866AD51997221D775A501CF80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3c4d3a3db847ffd23120e802a3f400a396ee245b6913fced4dcd4e7ce6beeb73
                                                                                                                  • Instruction ID: 790b42f2dfc16e48e4e3eb85d72794afa9e7730f4e68c52cb28cfac9306823ae
                                                                                                                  • Opcode Fuzzy Hash: 3c4d3a3db847ffd23120e802a3f400a396ee245b6913fced4dcd4e7ce6beeb73
                                                                                                                  • Instruction Fuzzy Hash: 9501B575E002169FCB00EFB9D8418AFF7F5FF89300710866AE618E7221E770A901CB80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 360fe8f1319b3a61ef7dd8cc1232387fb11cc5b1f6962c42901c22d8f940d86b
                                                                                                                  • Instruction ID: 27e69d17f0b60a2a9be53b637b8a760acd1d7432c3a71746ce26a91d1c2e8b6e
                                                                                                                  • Opcode Fuzzy Hash: 360fe8f1319b3a61ef7dd8cc1232387fb11cc5b1f6962c42901c22d8f940d86b
                                                                                                                  • Instruction Fuzzy Hash: 0BF09060A1D3CCAFC74257B859261DD7FF59D4B210F2848FAC9D4D7123D1214A1BC7A2
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 71cb7d1cf9fd7fc39ee6e675bdf0c4ab50e7a9cbcf6c3a44479ca14876f71fa5
                                                                                                                  • Instruction ID: 2fb2b98a15c553cad7a23d05ce808211baaf179176e4efd0a5b783a6fdb19ac9
                                                                                                                  • Opcode Fuzzy Hash: 71cb7d1cf9fd7fc39ee6e675bdf0c4ab50e7a9cbcf6c3a44479ca14876f71fa5
                                                                                                                  • Instruction Fuzzy Hash: 5CF01C729402069FEB24EF74D1697AD7BB0AB4825CF1408A8D402A73A5CBB59984CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000A.00000002.746077616.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 866af75a186e27e1df1138fe314ce6cc1624d6c29c374f270ec999f22fbdfab0
                                                                                                                  • Instruction ID: 939a6b4435383da1f663bcc4a284b02faf75553930b17dbf20188e1766caf03f
                                                                                                                  • Opcode Fuzzy Hash: 866af75a186e27e1df1138fe314ce6cc1624d6c29c374f270ec999f22fbdfab0
                                                                                                                  • Instruction Fuzzy Hash: 41D067B1D04229AF8B50EFB9A9091DEBBF8EE08250B1045A6D919E3204E6705A10CBD1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Non-executed Functions

                                                                                                                  Executed Functions

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 996cd7bd7162f2989e3337973a4ad4d0cab0fd5082013eaefbaeb7efc58a52a3
                                                                                                                  • Instruction ID: 9c2f54395690340ca5c07df8955856487440c947712bc108d29b49be5c6c2e01
                                                                                                                  • Opcode Fuzzy Hash: 996cd7bd7162f2989e3337973a4ad4d0cab0fd5082013eaefbaeb7efc58a52a3
                                                                                                                  • Instruction Fuzzy Hash: 3A327134B043058FC725EF74E8A46AA77F6EB88305B60857DC5069B39ADB75EC42CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 231d6a4fe46a5f86315d6858665fef38f88438da0b192d2db31234a94322368d
                                                                                                                  • Instruction ID: 9eba88d761c375d61ac22eec7e570b57587bf7aa8ba5112844c79e46625f8183
                                                                                                                  • Opcode Fuzzy Hash: 231d6a4fe46a5f86315d6858665fef38f88438da0b192d2db31234a94322368d
                                                                                                                  • Instruction Fuzzy Hash: 3581D035A043458FCB1A9F70D814ADABBF2AF88304F158969D4026B7A6DB75EC85DB40
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: cd14088a7d61707ce3fcc038a6506596905897347d25afe8a152528682d6c761
                                                                                                                  • Instruction ID: d6587b40834a7d6e6c9600e8da963eba4fb3a16c9efe5625b4d47f25eb75df63
                                                                                                                  • Opcode Fuzzy Hash: cd14088a7d61707ce3fcc038a6506596905897347d25afe8a152528682d6c761
                                                                                                                  • Instruction Fuzzy Hash: 703126757406108FC719AB78C46996E37E1AF9961932108BDE406CF7B2DF3ADC42CB80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 58f30054697254f893f5e225ad74c8290105c97629aa6ad3600d10732351114c
                                                                                                                  • Instruction ID: d48d70091b994f562fb2c4cd76b978d9d4bcfcf8e57dbfc45248b6cd90072ccb
                                                                                                                  • Opcode Fuzzy Hash: 58f30054697254f893f5e225ad74c8290105c97629aa6ad3600d10732351114c
                                                                                                                  • Instruction Fuzzy Hash: 2821F3757106118FC758AB78C45896E33E2AF8961936108B8E406CF7B6DF36EC42CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9f86df1e83bdc5c8bd4f8de85a5b7aaf30ee8a0cbaa3c522abea467080ff6cca
                                                                                                                  • Instruction ID: 7161015470f535373ef14ab1a49840c7ce47d3ba922fef158d8ba4851f5d7758
                                                                                                                  • Opcode Fuzzy Hash: 9f86df1e83bdc5c8bd4f8de85a5b7aaf30ee8a0cbaa3c522abea467080ff6cca
                                                                                                                  • Instruction Fuzzy Hash: 3C11A575E002059FCB05DFB8D8459EEBBF1FF89300B10866AE515AB262D7749511CB80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ac945a4e780e91506bc552995ed42db94faccc6aa5ee14b5d1ce554be0e06785
                                                                                                                  • Instruction ID: bc59dd3d54e250d014b7e3c0b2bc216631bc11f6306ffea13345ea1d957fc43c
                                                                                                                  • Opcode Fuzzy Hash: ac945a4e780e91506bc552995ed42db94faccc6aa5ee14b5d1ce554be0e06785
                                                                                                                  • Instruction Fuzzy Hash: 58019276E002059FCB40EFB8D8418AFF7F5FF89200710866AE514AB222E770E911CB80
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b34a9ddd3ebe31593b3ca6d75f52993c660f53b07bb8f9a34de16a62c41e2959
                                                                                                                  • Instruction ID: 1153a4d69c7ae85cbfadf21ab23d7351a04bf1adf241c168e7ec04c49e70b73e
                                                                                                                  • Opcode Fuzzy Hash: b34a9ddd3ebe31593b3ca6d75f52993c660f53b07bb8f9a34de16a62c41e2959
                                                                                                                  • Instruction Fuzzy Hash: 3CF0B4F1E0D3865FC7419F789A191DE7FF09E56200F1501EFC485D3163E1648914C752
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9a4d31fa65ca927aa36465e44030f2f511cac1bc1b052e307500cf0f5ce2ac09
                                                                                                                  • Instruction ID: 249897aed9ffbf6b148f7e4ea7d910d3a37414051987e2a6298aeaa7d7d948ee
                                                                                                                  • Opcode Fuzzy Hash: 9a4d31fa65ca927aa36465e44030f2f511cac1bc1b052e307500cf0f5ce2ac09
                                                                                                                  • Instruction Fuzzy Hash: FFF01C71A442059FDB14DFB4C059BEE7BF4BB08318F250898D042A73E2CB74AD84CB90
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3b3e29b6724e0f3f4031c16825f2b807fc781c4150fbdf6a83e8dd7ad6ffd795
                                                                                                                  • Instruction ID: f5e6b6a66cde0dea7ccd6b15f4cd0f2cfc73d11bb6bac04c47030a8972813bfb
                                                                                                                  • Opcode Fuzzy Hash: 3b3e29b6724e0f3f4031c16825f2b807fc781c4150fbdf6a83e8dd7ad6ffd795
                                                                                                                  • Instruction Fuzzy Hash: 3AD02E31B002248FC310EF78E808A863BBCEF08B11F1040A4EA08CB2A1DB32EC00CBD0
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000F.00000002.762257181.0000000000AB0000.00000040.00000001.sdmp, Offset: 00AB0000, based on PE: false
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 25f232774aa932d6ab343447ae86beeb5c1535d3ddc9eeff80acd003f0fb0236
                                                                                                                  • Instruction ID: 82c68e5550632972eac64ec3c9782f6e1d196ae4c2c43143c784e29994f6dc61
                                                                                                                  • Opcode Fuzzy Hash: 25f232774aa932d6ab343447ae86beeb5c1535d3ddc9eeff80acd003f0fb0236
                                                                                                                  • Instruction Fuzzy Hash: C9D067B1E04229AF8B40EFB999055DEBBF8EA09250B1045B6DA19E3211E6705A10DBD1
                                                                                                                  Uniqueness

                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                  Non-executed Functions