Play interactive tour

Edit tour

Analysis Report Scan copy.exe

Overview

General Information

Sample Name:	Scan copy.exe
Analysis ID:	433218
MD5:	502390a59aad886fa91210a1b89c89b5
SHA1:	b5ccfd3c93f4625bb46ddfb6bd314c7533653368
SHA256:	661bb6d9fd6302e1c06c8d3d6182720259df9ce73b5251127c21eb4883ebcf7f
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Contains functionality to register a low level keyboard hook

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Scan copy.exe (PID: 6048 cmdline: 'C:\Users\user\Desktop\Scan copy.exe' MD5: 502390A59AAD886FA91210A1B89C89B5)

schtasks.exe (PID: 5472 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Scan copy.exe (PID: 5988 cmdline: C:\Users\user\Desktop\Scan copy.exe MD5: 502390A59AAD886FA91210A1B89C89B5)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "maksat@atlmexco.comMa1301smtp.atlmexco.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Scan copy.exe PID: 6048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Scan copy.exe PID: 6048	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Scan copy.exe PID: 5988	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Scan copy.exe PID: 5988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.Scan copy.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.Scan copy.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3dd5270.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3dd5270.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3dd5270.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3dd5270.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Scan copy.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Scan copy.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3cb87f0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Scan copy.exe.3cb87f0.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "maksat@atlmexco.comMa1301smtp.atlmexco.com"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\emmrGOU.exe

ReversingLabs: Detection: 17%

Multi AV Scanner detection for submitted file

Show sources

Source: Scan copy.exe

ReversingLabs: Detection: 17%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\emmrGOU.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: Scan copy.exe

Joe Sandbox ML: detected

Source: 7.2.Scan copy.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Scan copy.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8

Source: Scan copy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Scan copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\fXDNGqRoBT\src\obj\x86\Debug\PermissionSetEntryFieldId.pdb source: Scan copy.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\fXDNGqRoBT\src\obj\x86\Debug\PermissionSetEntryFieldId.pdb8 source: Scan copy.exe

Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_0727DB00
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		0_2_0727EBD8

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49744 -> 93.89.24.35:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49745 -> 93.89.24.35:587

Source: global traffic

TCP traffic: 192.168.2.3:49744 -> 93.89.24.35:587

Source: Joe Sandbox View

ASN Name: BKVG-ASDE BKVG-ASDE

Source: global traffic

TCP traffic: 192.168.2.3:49744 -> 93.89.24.35:587

Source: unknown

DNS traffic detected: queries for: smtp.atlmexco.com

Source: Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000002.475024688.0000000003331000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000002.474880893.00000000032F9000.00000004.00000001.sdmp	String found in binary or memory: http://aJWYmLGLhn6n2.org
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Scan copy.exe, 00000000.00000002.226113577.0000000002BD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Scan copy.exe, 00000007.00000002.475024688.0000000003331000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.atlmexco.com
Source: Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://uZoqoU.com
Source: Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Scan copy.exe, 00000000.00000003.208021704.0000000005CB6000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmll
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Scan copy.exe, 00000000.00000003.208701839.0000000005CAE000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Scan copy.exe, 00000000.00000003.209057239.0000000005C89000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html2U
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comI.TTF
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalic$
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsd
Source: Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comascC
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcom
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comionmy
Source: Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: Scan copy.exe, 00000000.00000003.202582104.0000000005C8B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Scan copy.exe, 00000000.00000003.205522633.0000000005C76000.00000004.00000001.sdmp, Scan copy.exe, 00000000.00000003.204749021.0000000005C77000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Scan copy.exe, 00000000.00000003.204992463.0000000005C78000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Scan copy.exe, 00000000.00000003.205522633.0000000005C76000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnQ
Source: Scan copy.exe, 00000000.00000003.204490000.0000000005C7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnn
Source: Scan copy.exe, 00000000.00000003.212350163.0000000005C83000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Scan copy.exe, 00000000.00000003.212350163.0000000005C83000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmTP
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/het
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/hetJ
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/n
Source: Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/siv
Source: Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/uea$
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/vaoC
Source: Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/y
Source: Scan copy.exe, 00000000.00000003.201854697.0000000005C73000.00000004.00000001.sdmp, Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Scan copy.exe, 00000000.00000003.201854697.0000000005C73000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comr-t
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp, Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com(.
Source: Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.comx
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Scan copy.exe, 00000000.00000003.203905958.0000000005C8B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com%Q
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: Scan copy.exe, 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

Code function: 7_2_011C05C8 SetWindowsHookExW 0000000D,00000000,?,?

7_2_011C05C8

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Scan copy.exe

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 7.2.Scan copy.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bE75C8CE5u002d1AF8u002d4CE0u002d84ABu002d1AA9008845DAu007d/u0034688D7C8u002d0AC5u002d4F49u002d92F7u002d0AB75E92AF93.cs	Large array initialization: .cctor: array initializer size 11926
Source: 7.0.Scan copy.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007bE75C8CE5u002d1AF8u002d4CE0u002d84ABu002d1AA9008845DAu007d/u0034688D7C8u002d0AC5u002d4F49u002d92F7u002d0AB75E92AF93.cs	Large array initialization: .cctor: array initializer size 11926

Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07278F50	0_2_07278F50
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07279580	0_2_07279580
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_0727CC40	0_2_0727CC40
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07278480	0_2_07278480
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07278808	0_2_07278808
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07278F40	0_2_07278F40
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072787FA	0_2_072787FA
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07279570	0_2_07279570
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07278472	0_2_07278472
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07275CE0	0_2_07275CE0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07275CD2	0_2_07275CD2
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_0727A3B0	0_2_0727A3B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_0727E3B8	0_2_0727E3B8
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_0727A39F	0_2_0727A39F
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07274928	0_2_07274928
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07274919	0_2_07274919
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07274148	0_2_07274148
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07274158	0_2_07274158
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072731C0	0_2_072731C0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07270039	0_2_07270039
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07270040	0_2_07270040
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072738A0	0_2_072738A0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_07273889	0_2_07273889
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE7A60	0_2_08BE7A60
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEAC78	0_2_08BEAC78
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BECD40	0_2_08BECD40
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEBE58	0_2_08BEBE58
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEB4B0	0_2_08BEB4B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEE840	0_2_08BEE840
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEB939	0_2_08BEB939
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEB948	0_2_08BEB948
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE7A51	0_2_08BE7A51
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEABE0	0_2_08BEABE0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEEB30	0_2_08BEEB30
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEDC80	0_2_08BEDC80
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEEED8	0_2_08BEEED8
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEBE4A	0_2_08BEBE4A
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEF0F8	0_2_08BEF0F8
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEA0F0	0_2_08BEA0F0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEA0E1	0_2_08BEA0E1
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE0039	0_2_08BE0039
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE0040	0_2_08BE0040
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEF358	0_2_08BEF358
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE74B0	0_2_08BE74B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BEB4A2	0_2_08BEB4A2
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_08BE74A0	0_2_08BE74A0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_011CD138	7_2_011CD138
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_011CA1B0	7_2_011CA1B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_011CCF48	7_2_011CCF48
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_011CBBE4	7_2_011CBBE4
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_011C0C80	7_2_011C0C80
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_014946A0	7_2_014946A0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_014945B0	7_2_014945B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_01494630	7_2_01494630
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_0149DA30	7_2_0149DA30
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_0153C95C	7_2_0153C95C
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_01532B08	7_2_01532B08
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_015313C8	7_2_015313C8
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_0153B5C8	7_2_0153B5C8
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_015346B0	7_2_015346B0
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_01546890	7_2_01546890
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_01545B30	7_2_01545B30

Source: Scan copy.exe, 00000000.00000002.226113577.0000000002BD1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameyZmFnldYFSznTuqDxTayTtUJG.exe4 vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000000.198627508.0000000000962000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetEntryFieldId.exeZ vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000002.239479824.000000000E910000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000002.239479824.000000000E910000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000003.218712223.0000000003EDF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000002.239367857.000000000E820000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs Scan copy.exe
Source: Scan copy.exe, 00000000.00000002.238846395.0000000008A90000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Scan copy.exe
Source: Scan copy.exe, 00000007.00000000.224533623.0000000000D62000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePermissionSetEntryFieldId.exeZ vs Scan copy.exe
Source: Scan copy.exe, 00000007.00000002.477924509.0000000006430000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Scan copy.exe
Source: Scan copy.exe, 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameyZmFnldYFSznTuqDxTayTtUJG.exe4 vs Scan copy.exe
Source: Scan copy.exe, 00000007.00000002.469694000.00000000011D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs Scan copy.exe
Source: Scan copy.exe, 00000007.00000002.469262654.00000000010F8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Scan copy.exe
Source: Scan copy.exe	Binary or memory string: OriginalFilenamePermissionSetEntryFieldId.exeZ vs Scan copy.exe

Source: Scan copy.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Scan copy.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: emmrGOU.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 7.2.Scan copy.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.Scan copy.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Scan copy.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Scan copy.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@1/1

Source: C:\Users\user\Desktop\Scan copy.exe

File created: C:\Users\user\AppData\Roaming\emmrGOU.exe

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	Mutant created: \Sessions\1\BaseNamedObjects\QnZoDGZEfCHgFbAtrpNXfgIt
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3864:120:WilError_01

Source: C:\Users\user\Desktop\Scan copy.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3F10.tmp

Jump to behavior

Source: Scan copy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Scan copy.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Scan copy.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: Scan copy.exe

ReversingLabs: Detection: 17%

Source: C:\Users\user\Desktop\Scan copy.exe

File read: C:\Users\user\Desktop\Scan copy.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Scan copy.exe 'C:\Users\user\Desktop\Scan copy.exe'
Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Users\user\Desktop\Scan copy.exe C:\Users\user\Desktop\Scan copy.exe
Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Users\user\Desktop\Scan copy.exe C:\Users\user\Desktop\Scan copy.exe	Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Scan copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Scan copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Scan copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\fXDNGqRoBT\src\obj\x86\Debug\PermissionSetEntryFieldId.pdb source: Scan copy.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\fXDNGqRoBT\src\obj\x86\Debug\PermissionSetEntryFieldId.pdb8 source: Scan copy.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Scan copy.exe, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: emmrGOU.exe.0.dr, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Scan copy.exe.870000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Scan copy.exe.870000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.Scan copy.exe.c70000.1.unpack, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.Scan copy.exe.c70000.0.unpack, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.Scan copy.exe.c70000.2.unpack, Aspiring_Rookie/DebuggableAttribute.cs	.Net Code: FillRecta System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072761E8 push esp; iretd	0_2_072761E9
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072711C2 push ebx; iretd	0_2_072711C4
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 0_2_072711C9 push ebx; iretd	0_2_072711CE
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_0153BB1A pushfd ; iretd	7_2_0153BBB9
Source: C:\Users\user\Desktop\Scan copy.exe	Code function: 7_2_0153B3A8 pushfd ; retf	7_2_0153B3A9

Source: initial sample	Static PE information: section name: .text entropy: 7.86391692068
Source: initial sample	Static PE information: section name: .text entropy: 7.86391692068

Source: C:\Users\user\Desktop\Scan copy.exe

File created: C:\Users\user\AppData\Roaming\emmrGOU.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp'

Source: C:\Users\user\Desktop\Scan copy.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 6048, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Scan copy.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	Window / User API: threadDelayed 2677			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Window / User API: threadDelayed 7171			Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe TID: 6076	Thread sleep time: -102260s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe TID: 3840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe TID: 6080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe TID: 5716	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe TID: 2128	Thread sleep count: 2677 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe TID: 2128	Thread sleep count: 7171 > 30	Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Scan copy.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 102260	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Scan copy.exe, 00000007.00000002.471464886.00000000013CB000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Scan copy.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Code function: 7_2_015388B0 LdrInitializeThunk,

7_2_015388B0

Source: C:\Users\user\Desktop\Scan copy.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

Memory written: C:\Users\user\Desktop\Scan copy.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Process created: C:\Users\user\Desktop\Scan copy.exe C:\Users\user\Desktop\Scan copy.exe			Jump to behavior

Source: Scan copy.exe, 00000007.00000002.472515118.0000000001AA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Scan copy.exe, 00000007.00000002.472515118.0000000001AA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Scan copy.exe, 00000007.00000002.472515118.0000000001AA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Scan copy.exe, 00000007.00000002.472515118.0000000001AA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Users\user\Desktop\Scan copy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Users\user\Desktop\Scan copy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Scan copy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.Scan copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Scan copy.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3cb87f0.1.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 6048, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 5988, type: MEMORY
Source: Yara match	File source: 7.2.Scan copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Scan copy.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3cb87f0.1.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\Scan copy.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 5988, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 7.2.Scan copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Scan copy.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3cb87f0.1.raw.unpack, type: UNPACKEDPE

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 6048, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan copy.exe PID: 5988, type: MEMORY
Source: Yara match	File source: 7.2.Scan copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3dd5270.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Scan copy.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan copy.exe.3cb87f0.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Deobfuscate/Decode Files or Information1	Input Capture21	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Credentials in Registry1	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing13	NTDS	Security Software Discovery321	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Process Discovery2	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion141	Cached Domain Credentials	Virtualization/Sandbox Evasion141	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Scan copy.exe	17%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
Scan copy.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\emmrGOU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\emmrGOU.exe	17%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.Scan copy.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File
7.0.Scan copy.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnQ	0%	Avira URL Cloud	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.sajatypeworks.comr-t	0%	Avira URL Cloud	safe
http://www.tiro.com%Q	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/siv	0%	Avira URL Cloud	safe
http://smtp.atlmexco.com	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htmTP	0%	Avira URL Cloud	safe
http://www.sakkal.comx	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnn	0%	URL Reputation	safe
http://www.founder.com.cn/cnn	0%	URL Reputation	safe
http://www.founder.com.cn/cnn	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.	0%	URL Reputation	safe
http://www.fontbureau.comionmy	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fontbureau.comalic$	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://uZoqoU.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comalsd	0%	URL Reputation	safe
http://www.fontbureau.comalsd	0%	URL Reputation	safe
http://www.fontbureau.comalsd	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.sakkal.com(.	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.agfamonotype.	0%	URL Reputation	safe
http://www.fontbureau.comascC	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.atlmexco.com	93.89.24.35	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cnQ	Scan copy.exe, 00000000.00000003.205522633.0000000005C76000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comI.TTF	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comr-t	Scan copy.exe, 00000000.00000003.201854697.0000000005C73000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.tiro.com%Q	Scan copy.exe, 00000000.00000003.203905958.0000000005C8B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.tiro.com	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/siv	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.atlmexco.com	Scan copy.exe, 00000007.00000002.475024688.0000000003331000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmTP	Scan copy.exe, 00000000.00000003.212350163.0000000005C83000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.comx	Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	Scan copy.exe, 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.com	Scan copy.exe, 00000000.00000003.201854697.0000000005C73000.00000004.00000001.sdmp, Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cnn	Scan copy.exe, 00000000.00000003.204490000.0000000005C7E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comcom	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html2U	Scan copy.exe, 00000000.00000003.209057239.0000000005C89000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/.	Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comionmy	Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.html	Scan copy.exe, 00000000.00000003.208021704.0000000005CB6000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	Scan copy.exe, 00000000.00000003.202582104.0000000005C8B000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comalic$	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/$	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Scan copy.exe, 00000000.00000002.226113577.0000000002BD1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp, Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	Scan copy.exe, 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://uZoqoU.com	Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comalsd	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	Scan copy.exe, 00000000.00000003.212350163.0000000005C83000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com(.	Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comF	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.agfamonotype.	Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comascC	Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/n	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/J	Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://aJWYmLGLhn6n2.org	Scan copy.exe, 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000002.475024688.0000000003331000.00000004.00000001.sdmp, Scan copy.exe, 00000007.00000002.474880893.00000000032F9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comd	Scan copy.exe, 00000000.00000003.211341218.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/uea$	Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	Scan copy.exe, 00000000.00000003.204992463.0000000005C78000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/y	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/hetJ	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	Scan copy.exe, 00000000.00000003.205522633.0000000005C76000.00000004.00000001.sdmp, Scan copy.exe, 00000000.00000003.204749021.0000000005C77000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/het	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/n	Scan copy.exe, 00000000.00000003.207626091.0000000005C75000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.como	Scan copy.exe, 00000000.00000002.235863544.0000000005C70000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/vaoC	Scan copy.exe, 00000000.00000003.207848001.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	Scan copy.exe, 00000000.00000002.235904251.0000000005D60000.00000002.00000001.sdmp	false		high
http://www.ascendercorp.com/typedesigners.htmll	Scan copy.exe, 00000000.00000003.208029276.0000000005C75000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/	Scan copy.exe, 00000000.00000003.208701839.0000000005CAE000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
93.89.24.35	smtp.atlmexco.com	Turkey		29141	BKVG-ASDE	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433218
Start date:	11.06.2021
Start time:	13:20:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Scan copy.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 106 Number of non-executed functions: 29
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 92.122.145.220, 184.30.20.56, 20.50.102.62, 93.184.221.240, 20.54.7.98, 20.54.104.15, 20.54.26.129, 92.122.213.247, 92.122.213.194, 20.82.209.183 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:21:19	API Interceptor	765x Sleep call for process: Scan copy.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
93.89.24.35	Scan copy.exe	Get hash	malicious	Browse
93.89.24.35	Scan copy.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
BKVG-ASDE	Scan copy.exe	Get hash	malicious	Browse	93.89.24.35
	Scan copy.exe	Get hash	malicious	Browse	93.89.24.35
	https://ntmp-log.wowdigitech.com/ga/click/2-39854561-1849-12357-24298-27003-dbf48d5c17-74d2ecc202	Get hash	malicious	Browse	80.83.124.119
	https://win-tk.windows7indir.com/ga/click/2-39877771-1850-12356-24297-26999-89eb543f2e-072690a48c	Get hash	malicious	Browse	80.83.124.119
	Form.doc	Get hash	malicious	Browse	80.83.126.232
	https://fiera-deutzfahr.com/wp-admin/Overview/6555921/6uw9g10b-0079388/	Get hash	malicious	Browse	130.255.76.204
	FEk69sVIyf.exe	Get hash	malicious	Browse	5.45.186.113
	well.exe	Get hash	malicious	Browse	31.170.107.186
	hvavwcah.exe	Get hash	malicious	Browse	130.255.73.90
	326004368fa6e481cc228b4167a83e89e53ac232f4e4d14dbefb386614291722.exe	Get hash	malicious	Browse	130.255.73.90
	Font_update.exe	Get hash	malicious	Browse	130.255.78.223
	xasxas.exe	Get hash	malicious	Browse	130.255.73.90
	Emotet.doc	Get hash	malicious	Browse	80.83.113.182
	710288-30017168893.js	Get hash	malicious	Browse	5.45.186.113

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan copy.exe.log Download File
Process:	C:\Users\user\Desktop\Scan copy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp3F10.tmp Download File
Process:	C:\Users\user\Desktop\Scan copy.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.183557342788241
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBVtn:cbh47TlNQ//rydbz9I3YODOLNdq3x
MD5:	628D95CBD21900923D18951C3B798AFC
SHA1:	91B96CBB27F36D61599F6C591A1C118893D638E8
SHA-256:	EB8DD379D400083487B1E60229A102B6DC53D56F26C1DBE8C2FF1174D0C97414
SHA-512:	8FB4AB693C3FB2EF59C042FE54E38358B8D0ABF973A2C0AE9D31256F590344CEB5E93F431C0B805E8CE7B3531E260AA104EAB79B92E811C272BF8783F9EBE0A6
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\emmrGOU.exe Download File
Process:	C:\Users\user\Desktop\Scan copy.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	981504
Entropy (8bit):	7.8570248754229
Encrypted:	false
SSDEEP:	24576:aNUWE+vLs3S9FM1o9//fK37535oI9YLNeBUdt:aUWPLUSzM1ohXcB5oskwBU
MD5:	502390A59AAD886FA91210A1B89C89B5
SHA1:	B5CCFD3C93F4625BB46DDFB6BD314C7533653368
SHA-256:	661BB6D9FD6302E1C06C8D3D6182720259DF9CE73B5251127C21EB4883EBCF7F
SHA-512:	35F616C75B7409E1CC3869CAC75B5FB2D2AFC8FFA676306F163913B3696709D2EE2973A30AD0E033FB8229BA0BAA2E223A4DDA211149FC5D43512649F29AD046
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.............b.... ... ....@.. .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text...h.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................D.......H........T..4............Y..............................................0............(!...(".........(.....o#.........................($......(%......(&......('......((....N..(....o....()....&..(.....s+........s,........s-........s.........s/............0...........~....o0....+...0...........~....o1....+...0...........~....o2....+...0...........~....o3....+...0...........~....o4....+..&..(5.......0..<........~.....(6.....,!r...p.....(7...o8...s9............~.....

C:\Users\user\AppData\Roaming\emmrGOU.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\Scan copy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\no3dcizx.kcl\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\Scan copy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8570248754229
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Scan copy.exe
File size:	981504
MD5:	502390a59aad886fa91210a1b89c89b5
SHA1:	b5ccfd3c93f4625bb46ddfb6bd314c7533653368
SHA256:	661bb6d9fd6302e1c06c8d3d6182720259df9ce73b5251127c21eb4883ebcf7f
SHA512:	35f616c75b7409e1cc3869cac75b5fb2d2afc8ffa676306f163913b3696709d2ee2973a30ad0e033fb8229ba0baa2e223a4dda211149fc5d43512649f29ad046
SSDEEP:	24576:aNUWE+vLs3S9FM1o9//fK37535oI9YLNeBUdt:aUWPLUSzM1ohXcB5oskwBU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P.............b.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4f0c62
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60C1D106 [Thu Jun 10 08:44:54 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf0c10	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf2000	0x690	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf0ad8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeec68	0xeee00	False	0.881620797357	data	7.86391692068	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xf2000	0x690	0x800	False	0.34619140625	data	3.59855610159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xf2090	0x400	data
RT_MANIFEST	0xf24a0	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Sutton Grammar School 2015
Assembly Version	1.0.0.0
InternalName	PermissionSetEntryFieldId.exe
FileVersion	1.0.0.0
CompanyName	Sutton Grammar School
LegalTrademarks
Comments
ProductName	Aspiring Rookie - Basketball
ProductVersion	1.0.0.0
FileDescription	Aspiring Rookie - Basketball
OriginalFilename	PermissionSetEntryFieldId.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/11/21-13:23:03.338583	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49744	587	192.168.2.3	93.89.24.35
06/11/21-13:23:05.115833	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49745	587	192.168.2.3	93.89.24.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 13:23:02.843264103 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:02.895612001 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:02.898061991 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:02.998224974 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.000294924 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.054177046 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.058360100 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.110797882 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.112212896 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.172770023 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.174007893 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.226429939 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.226996899 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.281184912 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.281603098 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.335031033 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.335064888 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.338582993 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.338742971 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.338839054 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.338928938 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:03.392868996 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.393224955 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.396302938 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:03.438699007 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.559192896 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.611941099 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.612221003 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.613600969 CEST	49744	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.615945101 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.666496992 CEST	587	49744	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.671503067 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.671622038 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.784070969 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.784559011 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.837129116 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.837739944 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.890913010 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.892991066 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:04.953788996 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:04.954688072 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.007021904 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.007286072 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.060039997 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.061201096 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.113466978 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.113507032 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.115653992 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.115833044 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.115981102 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.116146088 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.116367102 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.116513968 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.116611958 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.116727114 CEST	49745	587	192.168.2.3	93.89.24.35
Jun 11, 2021 13:23:05.168135881 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.168453932 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.168575048 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.168725967 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.171982050 CEST	587	49745	93.89.24.35	192.168.2.3
Jun 11, 2021 13:23:05.220001936 CEST	49745	587	192.168.2.3	93.89.24.35

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 13:21:04.858053923 CEST	50620	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:04.908750057 CEST	53	50620	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:05.936623096 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:05.959909916 CEST	60152	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:05.987988949 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:06.023258924 CEST	53	60152	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:07.453860044 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:07.503900051 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:09.031088114 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:09.081160069 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:10.210530043 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:10.260708094 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:11.532289028 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:11.585221052 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:12.747402906 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:12.798675060 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:14.218070030 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:14.279876947 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:15.443774939 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:15.505371094 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:16.722050905 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:16.775012970 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:18.142812014 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:18.192919970 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:19.280986071 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:19.331515074 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:20.405694008 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:20.456350088 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:23.506949902 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:23.565922976 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:24.779799938 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:24.829953909 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:27.118074894 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:27.170423985 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:29.341922045 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:29.392920017 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:42.240418911 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:42.325696945 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:42.507977009 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:42.566560030 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 11, 2021 13:21:59.367866039 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:21:59.431173086 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:06.308432102 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:06.451673031 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:07.067660093 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:07.357808113 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:07.938100100 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:07.955164909 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:07.997762918 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:08.021619081 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:08.455746889 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:08.514463902 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:09.083976030 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:09.144045115 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:09.737756968 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:09.801655054 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:10.258017063 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:10.317037106 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:11.055785894 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:11.116753101 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:12.127274036 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:12.186142921 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:12.698261976 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:12.761614084 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:23.124176025 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:23.185925007 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:54.745781898 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:54.806931019 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 11, 2021 13:22:57.706727982 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:22:57.770560026 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 11, 2021 13:23:02.635009050 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 11, 2021 13:23:02.712393045 CEST	53	52123	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 11, 2021 13:23:02.635009050 CEST	192.168.2.3	8.8.8.8	0xcf90	Standard query (0)	smtp.atlmexco.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 11, 2021 13:23:02.712393045 CEST	8.8.8.8	192.168.2.3	0xcf90	No error (0)	smtp.atlmexco.com		93.89.24.35	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 11, 2021 13:23:02.998224974 CEST	587	49744	93.89.24.35	192.168.2.3	220 atilim.atilimfuar.com ESMTP Exim 4.94 Fri, 11 Jun 2021 14:22:38 +0300
Jun 11, 2021 13:23:03.000294924 CEST	49744	587	192.168.2.3	93.89.24.35	EHLO 688098
Jun 11, 2021 13:23:03.054177046 CEST	587	49744	93.89.24.35	192.168.2.3	250-atilim.atilimfuar.com Hello 688098 [84.17.52.18] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jun 11, 2021 13:23:03.058360100 CEST	49744	587	192.168.2.3	93.89.24.35	AUTH login bWFrc2F0QGF0bG1leGNvLmNvbQ==
Jun 11, 2021 13:23:03.110797882 CEST	587	49744	93.89.24.35	192.168.2.3	334 UGFzc3dvcmQ6
Jun 11, 2021 13:23:03.172770023 CEST	587	49744	93.89.24.35	192.168.2.3	235 Authentication succeeded
Jun 11, 2021 13:23:03.174007893 CEST	49744	587	192.168.2.3	93.89.24.35	MAIL FROM:<maksat@atlmexco.com>
Jun 11, 2021 13:23:03.226429939 CEST	587	49744	93.89.24.35	192.168.2.3	250 OK
Jun 11, 2021 13:23:03.226996899 CEST	49744	587	192.168.2.3	93.89.24.35	RCPT TO:<maksat@atlmexco.com>
Jun 11, 2021 13:23:03.281184912 CEST	587	49744	93.89.24.35	192.168.2.3	250 Accepted
Jun 11, 2021 13:23:03.281603098 CEST	49744	587	192.168.2.3	93.89.24.35	DATA
Jun 11, 2021 13:23:03.335064888 CEST	587	49744	93.89.24.35	192.168.2.3	354 Enter message, ending with "." on a line by itself
Jun 11, 2021 13:23:03.338928938 CEST	49744	587	192.168.2.3	93.89.24.35	.
Jun 11, 2021 13:23:03.396302938 CEST	587	49744	93.89.24.35	192.168.2.3	250 OK id=1lrfFG-0002pD-QB
Jun 11, 2021 13:23:04.559192896 CEST	49744	587	192.168.2.3	93.89.24.35	QUIT
Jun 11, 2021 13:23:04.611941099 CEST	587	49744	93.89.24.35	192.168.2.3	221 atilim.atilimfuar.com closing connection
Jun 11, 2021 13:23:04.784070969 CEST	587	49745	93.89.24.35	192.168.2.3	220 atilim.atilimfuar.com ESMTP Exim 4.94 Fri, 11 Jun 2021 14:22:40 +0300
Jun 11, 2021 13:23:04.784559011 CEST	49745	587	192.168.2.3	93.89.24.35	EHLO 688098
Jun 11, 2021 13:23:04.837129116 CEST	587	49745	93.89.24.35	192.168.2.3	250-atilim.atilimfuar.com Hello 688098 [84.17.52.18] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jun 11, 2021 13:23:04.837739944 CEST	49745	587	192.168.2.3	93.89.24.35	AUTH login bWFrc2F0QGF0bG1leGNvLmNvbQ==
Jun 11, 2021 13:23:04.890913010 CEST	587	49745	93.89.24.35	192.168.2.3	334 UGFzc3dvcmQ6
Jun 11, 2021 13:23:04.953788996 CEST	587	49745	93.89.24.35	192.168.2.3	235 Authentication succeeded
Jun 11, 2021 13:23:04.954688072 CEST	49745	587	192.168.2.3	93.89.24.35	MAIL FROM:<maksat@atlmexco.com>
Jun 11, 2021 13:23:05.007021904 CEST	587	49745	93.89.24.35	192.168.2.3	250 OK
Jun 11, 2021 13:23:05.007286072 CEST	49745	587	192.168.2.3	93.89.24.35	RCPT TO:<maksat@atlmexco.com>
Jun 11, 2021 13:23:05.060039997 CEST	587	49745	93.89.24.35	192.168.2.3	250 Accepted
Jun 11, 2021 13:23:05.061201096 CEST	49745	587	192.168.2.3	93.89.24.35	DATA
Jun 11, 2021 13:23:05.113507032 CEST	587	49745	93.89.24.35	192.168.2.3	354 Enter message, ending with "." on a line by itself
Jun 11, 2021 13:23:05.116727114 CEST	49745	587	192.168.2.3	93.89.24.35	.
Jun 11, 2021 13:23:05.171982050 CEST	587	49745	93.89.24.35	192.168.2.3	250 OK id=1lrfFI-0002pW-J2

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Scan copy.exe PID: 6048 Parent PID: 5692

General

Start time:	13:21:10
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\Scan copy.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Scan copy.exe'
Imagebase:	0x870000
File size:	981504 bytes
MD5 hash:	502390A59AAD886FA91210A1B89C89B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.228452111.0000000003BD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.226158460.0000000002C11000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 5472 Parent PID: 6048

General

Start time:	13:21:21
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\emmrGOU' /XML 'C:\Users\user\AppData\Local\Temp\tmp3F10.tmp'
Imagebase:	0x990000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3864 Parent PID: 5472

General

Start time:	13:21:21
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: Scan copy.exe PID: 5988 Parent PID: 6048

General

Start time:	13:21:22
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\Scan copy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Scan copy.exe
Imagebase:	0xc70000
File size:	981504 bytes
MD5 hash:	502390A59AAD886FA91210A1B89C89B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.224405291.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.472756122.0000000003081000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000002.467056763.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Scan copy.exe PID: 6048 Parent PID: 5692 Scan copy.exeCOMMON

Executed Functions

Function 08BECD40, Relevance: 6.5, Strings: 5, Instructions: 296COMMON

Download Yara Rule

Strings

J52, xrefs: 08BECEB3
J52, xrefs: 08BECEBA
TZT, xrefs: 08BECE0F
eSw, xrefs: 08BED095
eSw, xrefs: 08BED09C

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID: J52$J52$TZT$eSw$eSw
API String ID: 0-3243454298
Opcode ID: 9e7fbe860c4f34e11bcf0be4487b835e8c956572a3d3e771699ba7a2d3233d61
Instruction ID: 946d95f2c15829df2429f9230019c62f1b37ebe9d19ddca53ebe543c721566d3
Opcode Fuzzy Hash: 9e7fbe860c4f34e11bcf0be4487b835e8c956572a3d3e771699ba7a2d3233d61
Instruction Fuzzy Hash: EED12674E2020ADFCB18CF95C8958AEFFB2FF89301B54D599E416AB214C735A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08BEABE0, Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

T>?, xrefs: 08BEADF8

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID: T>?
API String ID: 0-3837259657
Opcode ID: 6ac5376874e7f193d9b856b7a0c52627f96b0c395bb7d82100e4144ea9796614
Instruction ID: e19868cbcf40cc901bf742836f22ad8db407ed631f7d3de36d0892fc079f60bc
Opcode Fuzzy Hash: 6ac5376874e7f193d9b856b7a0c52627f96b0c395bb7d82100e4144ea9796614
Instruction Fuzzy Hash: DD911170E002588FDB08CFA9C884ADEFFB6EF99311F24806AE815BB354DB359945CB55

Uniqueness

Uniqueness Score: -1.00%

Function 08BEAC78, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

T>?, xrefs: 08BEADF8

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID: T>?
API String ID: 0-3837259657
Opcode ID: 2b20cb8f7097fc30f236c104cccb1ff3edaa1d274cf33f3d6f6ccf8d75116f5a
Instruction ID: 43a3351be2584b19d4e4669520b47d586c8b4b6b284e877617e05d17fff8d599
Opcode Fuzzy Hash: 2b20cb8f7097fc30f236c104cccb1ff3edaa1d274cf33f3d6f6ccf8d75116f5a
Instruction Fuzzy Hash: 8381D274E102198FDB08CFA9C9846AEFBB6FF99301F20942AE419BB354DB349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 07279570, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

>JW, xrefs: 07279674

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID: >JW
API String ID: 0-2367699924
Opcode ID: 1f483cae0189fee8a3fbb4a779e6bc3a9ec440d7941c1b86be04121564a92dcb
Instruction ID: 2fccac5dbf3884feb7c323d1e59fdd1970c4db118880f223efde8514ae321276
Opcode Fuzzy Hash: 1f483cae0189fee8a3fbb4a779e6bc3a9ec440d7941c1b86be04121564a92dcb
Instruction Fuzzy Hash: 878102B4E21219DFCB04DFA5D9445AEFBB2FF89300F60802AE816AB754DB745942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07279580, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

>JW, xrefs: 07279674

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID: >JW
API String ID: 0-2367699924
Opcode ID: a21ac086689e949f9ef134c7eae1f0d6fa1b3ba08a542c5cd89b248be255790c
Instruction ID: 4acb78756dc1d97dc6474756901a583cdf0e4d20d134d62ce4142a23062d0d96
Opcode Fuzzy Hash: a21ac086689e949f9ef134c7eae1f0d6fa1b3ba08a542c5cd89b248be255790c
Instruction Fuzzy Hash: 7481F2B4E21219DFCB04DFA5D9445AEFBB2FF89300F60802AE916AB754DB709941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07278F50, Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c8329bfad9b8971791fb8cb046d324f36ce7a06d75f19b44ebd57538c3c145
Instruction ID: df65ee241cc79daba94937e6e0c1322b4389bd7d43c7e22087fac358a617ccbf
Opcode Fuzzy Hash: 45c8329bfad9b8971791fb8cb046d324f36ce7a06d75f19b44ebd57538c3c145
Instruction Fuzzy Hash: AED10770E252189FDB04CFA5D945BDDFBB2FB89300F209529E40ABB394DB74A941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 07278F40, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fb080d49e31333f4cda36157792fccedff5b993130a8ec908677b3e2f01096
Instruction ID: 1a69882697a5501bd93299386be817b83082973f4474e9de8c6ae088556917a8
Opcode Fuzzy Hash: b0fb080d49e31333f4cda36157792fccedff5b993130a8ec908677b3e2f01096
Instruction Fuzzy Hash: 07D10770E212189FDB14CFA5D945BDDFBB2FB89300F209529E40ABB394DB749941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0727CC40, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c606b1916fe4e06a35703d8464017507d77a117ad1ead4e6d3614f2274b4c773
Instruction ID: 672614725ac63fea935eab59c8c2ea4db268de1a8adbe268fe26ff312c5bd723
Opcode Fuzzy Hash: c606b1916fe4e06a35703d8464017507d77a117ad1ead4e6d3614f2274b4c773
Instruction Fuzzy Hash: 06D1E8B4A105058FCB18DF69C698EA9B7F1BF4D705F1580A9E509EB361DB31AD80CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08BE7A60, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b1a430f2ee3b952b0c058c6b92b9fc21deab04975954cdbe78ecab393f2d08
Instruction ID: 568193fce659aacb61ef6d462cdf9e864aa390d0ef7daf9d417a3befacd1be25
Opcode Fuzzy Hash: b2b1a430f2ee3b952b0c058c6b92b9fc21deab04975954cdbe78ecab393f2d08
Instruction Fuzzy Hash: FDA1F6B0E00219CFDB24DFA5C844BEEBBB2BF89305F10C5A9E408A7241DB3599868F55

Uniqueness

Uniqueness Score: -1.00%

Function 08BE7A51, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6b62231186ee5da4006b7fb8b12cbe545fa76875fadb968aa3c438bb6bb84b
Instruction ID: bff6b5c0158ee56c60ae3ea1a0fda02ed1c60c2c84a903f5930a6cff19f358a6
Opcode Fuzzy Hash: ab6b62231186ee5da4006b7fb8b12cbe545fa76875fadb968aa3c438bb6bb84b
Instruction Fuzzy Hash: 2D91F771E00219CFDB24DFB9C844BEEBBB2AF89305F14D5A9E448A7241DF305A868F55

Uniqueness

Uniqueness Score: -1.00%

Function 07278808, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bf5a7c42fb227421a807dca219f51000d43a4a7d1e92e1ea95e57ab873c629
Instruction ID: fe4615131760dd97d09eb3201423956e5a72161914e5b36af5afac161c51e05c
Opcode Fuzzy Hash: 85bf5a7c42fb227421a807dca219f51000d43a4a7d1e92e1ea95e57ab873c629
Instruction Fuzzy Hash: 145159B0E35219DBCB48CFA5DA455DEFBF2FB8E210F24A426D006B7254DB749901CB28

Uniqueness

Uniqueness Score: -1.00%

Function 072787FA, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a260e2ef7f18497608a407359b8ea2552bcc77946cd8107a3e538c0629bf1ca
Instruction ID: c3d20eaf9f499a446374d85e388899d85d147505e2204c934f3146de78ec0879
Opcode Fuzzy Hash: 0a260e2ef7f18497608a407359b8ea2552bcc77946cd8107a3e538c0629bf1ca
Instruction Fuzzy Hash: 0A515BB0E25219DBCB48CFA5DA455DEFBF2FF8E210F24942AD406B7254DB749901CB28

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB4B0, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e299e97568dbc0a828907d86e453d9ea103b71800eb473f5493da7565f5577
Instruction ID: 5bfb4f68c8b0b9b2f828b46801fe6b637459047e191daac675bee6d022c7f71f
Opcode Fuzzy Hash: 27e299e97568dbc0a828907d86e453d9ea103b71800eb473f5493da7565f5577
Instruction Fuzzy Hash: 76512970E052198FDB08CFAAD9506EEFBF2FB88311F24D16AE419B7254D73499418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB4A2, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287302ba7a26735c7ca98932a0e1f7a4ac867f2ec94628a50a672e3a14d92fad
Instruction ID: a801a8fc243d9dde23ba7596a9554d3d523b329a835ccc671ad301ff192a2bd4
Opcode Fuzzy Hash: 287302ba7a26735c7ca98932a0e1f7a4ac867f2ec94628a50a672e3a14d92fad
Instruction Fuzzy Hash: CA511970E052199FDB08CFAAD9506AEFBF2FB88311F14C16AE419B7254DB3499418BA4

Uniqueness

Uniqueness Score: -1.00%

Function 07278480, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a8b4ed927d69ecbb0208c6aa674b7ae7aadfdeda3f469b0ad5b628c0ec8da6
Instruction ID: b62de1ecb12ae07869ed32519ad18bfeb1dc428520fcf7af879cbd506fe1eca5
Opcode Fuzzy Hash: b7a8b4ed927d69ecbb0208c6aa674b7ae7aadfdeda3f469b0ad5b628c0ec8da6
Instruction Fuzzy Hash: 91316174E25219CBCB08CFA5DA595DEFBF6FB8D210F50A42AD106B7254DB749804CB28

Uniqueness

Uniqueness Score: -1.00%

Function 07278472, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cca45f80b3f2acc24a32b3d6746c947de8ff4185fc26508362353a7a5664d34
Instruction ID: 35ce09966590a73fb2a7fc7a12f3b3e8080a6603c3b1dd2a0f526da22f09e4b4
Opcode Fuzzy Hash: 2cca45f80b3f2acc24a32b3d6746c947de8ff4185fc26508362353a7a5664d34
Instruction Fuzzy Hash: DD318F74E25219CFCB08CFA5DA595DEBBF6FB8D210F14942AD106B7254DB749804CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0727DB00, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd12c6d39b5a2e8a109ff9176fea9940c49e5a43cb2701ed4060c8dc026606b
Instruction ID: a29a29812198ccccf8d5a2f93bee8dfc359060b21b8ebdaf22a0322a49290a8d
Opcode Fuzzy Hash: 0bd12c6d39b5a2e8a109ff9176fea9940c49e5a43cb2701ed4060c8dc026606b
Instruction Fuzzy Hash: 693149B0E26219EFDB14DFA4D5587EDBBF5AF8A300F106429E401B3240CBB44940CF68

Uniqueness

Uniqueness Score: -1.00%

Function 08BEBE58, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb7585de7f4defe6429d9ed6a0705ccc1f694a271cb345f4483818af9445ccc
Instruction ID: 3284bd18b0a7d392aba14090f1dac9709d769faede6a0c09e22aa111192628af
Opcode Fuzzy Hash: 1fb7585de7f4defe6429d9ed6a0705ccc1f694a271cb345f4483818af9445ccc
Instruction Fuzzy Hash: 9D31E5B1E006189BEB18CF9BD8443DEFBF6EFC8310F14C16AD409A6258DB341A498F90

Uniqueness

Uniqueness Score: -1.00%

Function 08BEBE4A, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b458e5f1705c349bedef88b5dac37535ba82dbf1e09fd94ef106193ad21a85c
Instruction ID: b557092752997d47659babfb2e11e9e0a8920cd9fe712b9e2f5f2b60bebaf3af
Opcode Fuzzy Hash: 7b458e5f1705c349bedef88b5dac37535ba82dbf1e09fd94ef106193ad21a85c
Instruction Fuzzy Hash: 2631C9B1D006589BEB18CF9BC9547DEBFF2AFC9310F14C169D409AA258DB741A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072772CC, Relevance: 1.8, APIs: 1, Instructions: 272processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0727750E

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2e119da67d660e6d6ae4d167c3561e9c39b276e4af139ae30c4fe31e79230462
Instruction ID: c900fd112bf8d61b00b133851b0ccce7e5331da6ea11fbb58daedf3bc0526647
Opcode Fuzzy Hash: 2e119da67d660e6d6ae4d167c3561e9c39b276e4af139ae30c4fe31e79230462
Instruction Fuzzy Hash: 4FA15AB1D1021ACFDB20DFA8C981BEDBBB2FB48314F148569E819A7350DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 072772D8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0727750E

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b462081c428c61a5752ed09b49c05d3847e0b36704a4d94a67d828484ff2da48
Instruction ID: b56aacc0b089fe86d4936d25dab049c1fe68410c09c657b55d8b3c32f7eb50d7
Opcode Fuzzy Hash: b462081c428c61a5752ed09b49c05d3847e0b36704a4d94a67d828484ff2da48
Instruction Fuzzy Hash: EA914AB1D1021ACFDB24DFA8C981BEDBBB2BF48314F148569E819A7340DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07276F37, Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07276FFE

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a5aa0277748a754b1b2169a37c97bbc4b16d5ee77790ab08a216aba66e6f82e2
Instruction ID: f668265172033193431e21df67f79fb16b2969a097b29423674dd10a08bd0efb
Opcode Fuzzy Hash: a5aa0277748a754b1b2169a37c97bbc4b16d5ee77790ab08a216aba66e6f82e2
Instruction Fuzzy Hash: A631CBB290034A9BCB20CFA9D545ADEFFF4EF48324F14881AD519AB211C7359955CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 07277048, Relevance: 1.6, APIs: 1, Instructions: 92injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072770E0

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4cfaa4dfe80ff88b3dd99d088c0bef83390aed051c1d7169d16d97096b08874b
Instruction ID: bf3cc335bc8e9bd3511aede17e34eddca9aa682099995db72842886263dffef2
Opcode Fuzzy Hash: 4cfaa4dfe80ff88b3dd99d088c0bef83390aed051c1d7169d16d97096b08874b
Instruction Fuzzy Hash: A4315AB19002599FCF10DFA9C884BEEBBF5FF48324F14842AE955A7341C778A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07276838, Relevance: 1.6, APIs: 1, Instructions: 84threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 072768BE

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7ca915d223fcbbc40614f4a06583cdfc7d2eb7ce8e41da69280e5a1c175f8cb8
Instruction ID: f382befdaae54a4fb8c4924d1ad7a97b80d33541effe8573b6e115d4ab0842ed
Opcode Fuzzy Hash: 7ca915d223fcbbc40614f4a06583cdfc7d2eb7ce8e41da69280e5a1c175f8cb8
Instruction Fuzzy Hash: CE316DB1D002098FCB10DFAAC5847EEFBF1EF88268F14842AE515A7740D774A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07276788, Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072767F2

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 509ee5303e0c06783ac5005e745ac7dc0d43ced03b22cb03e74acd0547b801f4
Instruction ID: 3d3637f5a0c3ddfb76001c0339ec8c1a52d0fb5172a9c25ab57aadddf578a6bb
Opcode Fuzzy Hash: 509ee5303e0c06783ac5005e745ac7dc0d43ced03b22cb03e74acd0547b801f4
Instruction Fuzzy Hash: E2218BB0D002498FCB20DFA9C9447EEBBF4EB48328F148569D528AB740CB356945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07277050, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072770E0

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b7d1099d45ec8f228506097569a633cd217a60c4c443dc595a8d19e86205db39
Instruction ID: a4aa9d25e0d8b5ad953d94021a90a7ff6513c356d63ba57ffcd01704c9946406
Opcode Fuzzy Hash: b7d1099d45ec8f228506097569a633cd217a60c4c443dc595a8d19e86205db39
Instruction Fuzzy Hash: B72126B19003499FCB10DFA9C884BDEBBF5FF48314F108429E919A7340D7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07277138, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072771C0

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 66f7fae77122770aaeab65d9fe641c45ca28ca06419e74fee78a8ff356b47d0e
Instruction ID: b710b2a645f79415a3c5741b131793f33729ba7a59950e86c47f08ef8b77ae0e
Opcode Fuzzy Hash: 66f7fae77122770aaeab65d9fe641c45ca28ca06419e74fee78a8ff356b47d0e
Instruction Fuzzy Hash: 622136B1C002099FCB10DFA9C980BEEBBB5BF48314F50842AE919A7240D7389904DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07277140, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 072771C0

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0f09c7391c93a59a172ddefa8b10aceabd518d268dc7685bdca3eb9e32c6824a
Instruction ID: 98fbca0ad2487d1aa400f61fc25d12dc2dd91c8a907940742776d3e508a98c3e
Opcode Fuzzy Hash: 0f09c7391c93a59a172ddefa8b10aceabd518d268dc7685bdca3eb9e32c6824a
Instruction Fuzzy Hash: D02116B19002499FCB10DFAAC884BEEBBB5FF48314F508429E519A7240D7789944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07276840, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 072768BE

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f49b62e7b6739077bd3eeb7e115858a1be4dd24c529dd83a2e5d936d26a6dbf1
Instruction ID: abcb76c6a052a55c157146a66358f7a92a3f6bf8e759ac78e8b4b02ba3065d5b
Opcode Fuzzy Hash: f49b62e7b6739077bd3eeb7e115858a1be4dd24c529dd83a2e5d936d26a6dbf1
Instruction Fuzzy Hash: 442118B1D007098FCB10DFAAC5847EEBBF4AF48264F548429E519A7740DB78A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072727B8, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07272833

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8506d28dbc26dac9e7e135ef6184edcf723a5de2e3a88287cedd9ed03c2e132b
Instruction ID: 2c2d2d23deed55d891cd14662a84e162bd21b6177e30658f34a4bbbf950185e0
Opcode Fuzzy Hash: 8506d28dbc26dac9e7e135ef6184edcf723a5de2e3a88287cedd9ed03c2e132b
Instruction Fuzzy Hash: 4F2106B5D002099FCB10DF9AC584BDEBBF4FB48324F148429E969A7650D3789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072727C0, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07272833

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e0b648e7132699bb00d4710301c7bc9255723f05428651cacb05b1b9ce47f879
Instruction ID: 02f7cc16ae6d1eaab458fbae72c04502fd11df91efb00eb2851c1381cfc41750
Opcode Fuzzy Hash: e0b648e7132699bb00d4710301c7bc9255723f05428651cacb05b1b9ce47f879
Instruction Fuzzy Hash: 6C2117B5D002099FCB10DF9AC584BDEFBF4FB48320F108429E569A3250D379A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07276F90, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07276FFE

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1ae1a500bf4180426b7e71d462578924eab7d8b45a5f74551a7819cb83aade85
Instruction ID: 0f67fb409778ab0a5b9b679b0ee63d6b67fc9d99890ebcde20968d5ae83f4575
Opcode Fuzzy Hash: 1ae1a500bf4180426b7e71d462578924eab7d8b45a5f74551a7819cb83aade85
Instruction Fuzzy Hash: C81137719002499FCF10DFAAC844BDFBBF5EF48324F148819E525A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07276790, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072767F2

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0efcb67f740c08deb6d92ab0bcfd35dd95d4007c768215c4ce14ca5f8017539f
Instruction ID: 815a355f9419f7bb7607114a33ae7112cc55a98ce4dab04003bf89fa17405dc9
Opcode Fuzzy Hash: 0efcb67f740c08deb6d92ab0bcfd35dd95d4007c768215c4ce14ca5f8017539f
Instruction Fuzzy Hash: F5113AB1D042498FCB10DFAAC444BDFFBF4EB88224F148829D519A7740C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0727C348, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0727C3A5

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f086c3c58ef2d1e66f82035de0f43209b180558b5d03b2599c9dcb49f036d29e
Instruction ID: 1defb7a20ee50961e3ff8e3c577c8918bfe6c83e72cdb71bd9b1200172dff31a
Opcode Fuzzy Hash: f086c3c58ef2d1e66f82035de0f43209b180558b5d03b2599c9dcb49f036d29e
Instruction Fuzzy Hash: 7111D3B58002499FDB20DF9AD988BDEBBF8EB48324F10841AE915A7600C375A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08BE70F0, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fede907bc8ddd36cfbda08f3bea40985a4225a6a875712331019dd55bf3f592e
Instruction ID: 03875cadef5ca1b6a92fa6f6de95df3049de08a8cad4585d55985412f9733304
Opcode Fuzzy Hash: fede907bc8ddd36cfbda08f3bea40985a4225a6a875712331019dd55bf3f592e
Instruction Fuzzy Hash: 2F614B35A00619DFDB14DFA8C854A9DBBF1FF89311F218159E809AB364DB71ED81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 08BE70E1, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b045bfd22ba261aa2ffc187f3831880f2b86848ebeb3f8e69ea73d1ff5b31b2
Instruction ID: 33b908196da5e5b545eb3cc6cdbc9d29d8005ae17d9223c479fb1ba32dfc831c
Opcode Fuzzy Hash: 5b045bfd22ba261aa2ffc187f3831880f2b86848ebeb3f8e69ea73d1ff5b31b2
Instruction Fuzzy Hash: 84614935A00619DFDB14DFA8C454A9DBBF1FF89311F218169E809AB3A4DB71ED81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6928, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53afaa1a27c0f1a32eab57463f42e09b405a87433291159dfdfd8a257b62b5b
Instruction ID: 956d64990f90936387453a173e5734a2a4e67314325c807ab6ca684258e41a98
Opcode Fuzzy Hash: b53afaa1a27c0f1a32eab57463f42e09b405a87433291159dfdfd8a257b62b5b
Instruction Fuzzy Hash: CE41CC31B102058FCB14DB79C8485AFBBB6EFD92257158569E429CB390EF30DC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 08BE5ED8, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db8f74ec68fef57e1a30be87521ebba0727d0caaef83c4f655c451ab866f7fd
Instruction ID: 44b7f465ed6844013d0496808b9524d10caf3aa96258d5aa2174c710187a9483
Opcode Fuzzy Hash: 1db8f74ec68fef57e1a30be87521ebba0727d0caaef83c4f655c451ab866f7fd
Instruction Fuzzy Hash: 8B51E070E00219CFDB14DFA9D4846EEBBF6FF99305F10846AE409AB251DB359946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08BE677C, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8604d9eb79a418087be6c32b925cfa662d16fff68b49d55ecd2a633113b144c8
Instruction ID: 988c242fe5fa974c462c0ec297d4f4ceba6c2d5d7766092c2a3f946276c56a0d
Opcode Fuzzy Hash: 8604d9eb79a418087be6c32b925cfa662d16fff68b49d55ecd2a633113b144c8
Instruction Fuzzy Hash: 80414871D0070A9FCB10DFAAC8446EEFBF4FF88310F10851AE519B3200E774A6858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB6B9, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eefb241724a82d78beb897b92cf8f05272fb9671ad7fc3c4e197fdf1d9c25ac
Instruction ID: 05360d141f1bb4f5f299a61e5199e23c0ce9dab9a619f710be72a789c07f35dd
Opcode Fuzzy Hash: 1eefb241724a82d78beb897b92cf8f05272fb9671ad7fc3c4e197fdf1d9c25ac
Instruction Fuzzy Hash: 6131C6B4E042099FCB44CFA9C580AAEBBF2FF88311F1495AAD819A7754D7349A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB6C8, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f4116299a9348eb78bab417f32582f2b12dfd5100bda61c1e14cf698e8138d
Instruction ID: f379dc3ca5e90e6a4746c44216fd01de6d64794865c06392e49c37efc246d643
Opcode Fuzzy Hash: 00f4116299a9348eb78bab417f32582f2b12dfd5100bda61c1e14cf698e8138d
Instruction Fuzzy Hash: D631B5B4E0421ADFCB44CFA9C580AAEBBF2FF88311F1095AAD819A7754D7349A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0112D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225912613.000000000112D000.00000040.00000001.sdmp, Offset: 0112D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78b9e172ef2ee79022e91900d952f2b324ff18631074d7240af387aa9e4d4f8
Instruction ID: 79b1f51b0493d93266c24bae3f5d5c892a0ec66004f98d10874b9c7e2a126027
Opcode Fuzzy Hash: f78b9e172ef2ee79022e91900d952f2b324ff18631074d7240af387aa9e4d4f8
Instruction Fuzzy Hash: 34213AB1504240DFDF09DF94E9C0B26BF75FB88328F2485A9E9054B206C376D866CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0113D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225938375.000000000113D000.00000040.00000001.sdmp, Offset: 0113D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b09505ae35f9c2fcb13eee74fcbbb5ccaefb8f525e2bf86f2802181ecd6fbf
Instruction ID: 7ccc50f6c9521be18a113bdf4007959c5640ce3c1fb5947f924f247588a5625c
Opcode Fuzzy Hash: 78b09505ae35f9c2fcb13eee74fcbbb5ccaefb8f525e2bf86f2802181ecd6fbf
Instruction Fuzzy Hash: F32137B1504200DFDF09DFA4E9C0B26BB65FBC4328F60C5ADE8094B24AC736D806CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0113D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225938375.000000000113D000.00000040.00000001.sdmp, Offset: 0113D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922308a933aa9dc718fcc039bee1f85517280779d94862b2bde7068a165a3ec9
Instruction ID: 6d037b4771e14330c5be90d314665f27a5702c4fe95d0463634129c97ac74bea
Opcode Fuzzy Hash: 922308a933aa9dc718fcc039bee1f85517280779d94862b2bde7068a165a3ec9
Instruction Fuzzy Hash: AF2125B1504240DFDF19DF64E9C0B26FB65FB84754F60C5A9E84A4B24AC736D807CB62

Uniqueness

Uniqueness Score: -1.00%

Function 08BED340, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0e3cab2df44687d740ee10695ed168c3ede0f6716549af892b547f8e68a07a
Instruction ID: af554d9464b46ea73e1173f0650b52f414cb64f8e36d5c65a0eafcfdcdb38922
Opcode Fuzzy Hash: 4c0e3cab2df44687d740ee10695ed168c3ede0f6716549af892b547f8e68a07a
Instruction Fuzzy Hash: 67216DB0D1420ADFDB48CFA9C5416AEFBF1EF89301F24C5A9E409A7214E7709B41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6ACC, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94728fdab1c98d25b64ff83ced7ed48cb4ef48a31cf8da76b44254981295072c
Instruction ID: e17e32e4f361ec2919144b6b6b3932afbde868e19bbda05107dd2b42e77a03c5
Opcode Fuzzy Hash: 94728fdab1c98d25b64ff83ced7ed48cb4ef48a31cf8da76b44254981295072c
Instruction Fuzzy Hash: 8F31E0B0C016189FDB20DFA9C989BCEBFF4AB59314F64855AE404BB290C7B59845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB800, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbea2af90229db7b98fe63608f8cba9e8d048313ba3c7fdfb42cb60f2cb9cea
Instruction ID: e7b49b2472010fe687ea55bff465fe1023ad62726a8b2b2105284774d6116f5d
Opcode Fuzzy Hash: 4dbea2af90229db7b98fe63608f8cba9e8d048313ba3c7fdfb42cb60f2cb9cea
Instruction Fuzzy Hash: 3C21B4B0E04219DFCB44DFA9C5819AEBBF2FF88315F1189A9D418A7315E7349A418F91

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6AD8, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90dcca58c2c026664c6adc840c9799aaea29e7baf5c0c47df06da837e416e9e
Instruction ID: 23e28bea3d857e7f8c83604eeba1b188b5dc85bbe4042eca8dc94f3161fcf946
Opcode Fuzzy Hash: d90dcca58c2c026664c6adc840c9799aaea29e7baf5c0c47df06da837e416e9e
Instruction Fuzzy Hash: 7C21D0B0C01618DFDB20DFA9C589BCEBFF4AB59314F24805AE404BB250C7B55945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB7F0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4460279f8495be567c63d8b339685dbebf396711a9ba23abae9b4e5d49a96e2f
Instruction ID: 27d3847fe176376af3baadcdaa423f4b586c254561390ddd37b23e56bdae23ff
Opcode Fuzzy Hash: 4460279f8495be567c63d8b339685dbebf396711a9ba23abae9b4e5d49a96e2f
Instruction Fuzzy Hash: 752127B0E002099FCB04CFA9C581AAEBBF2FF89315F1585A9D818AB315D7309A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6430, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5c05c54e8f0b84c74515276d718092575c8afa795283f29c5d5ab101526555
Instruction ID: 25090ed7910b88e15eda987e8796dd2669fda72d40d37923afcd5177ab6782a0
Opcode Fuzzy Hash: ad5c05c54e8f0b84c74515276d718092575c8afa795283f29c5d5ab101526555
Instruction Fuzzy Hash: 3E118C32F0024A8F8F54EBB888115EEB7B6EFE5255B5000BAD504E7B01FB35D916CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0113D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225938375.000000000113D000.00000040.00000001.sdmp, Offset: 0113D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb6d37a1c43defa97b97a69c7506d2bd67e31b5ed707131898afcdd97687343
Instruction ID: df2fa9653e1860cc79bc053bbf25817229b47fb1a1e2b84225368f95bbf3c8f5
Opcode Fuzzy Hash: 2fb6d37a1c43defa97b97a69c7506d2bd67e31b5ed707131898afcdd97687343
Instruction Fuzzy Hash: D62180754083809FCB06CF64D994B11BF71EB86314F28C5DAD8498F667C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 08BE691A, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbcc7404c44bc5d67a7d9daa789b0fadc73064cee8f950fadd7e0d1dcaeca71
Instruction ID: 18acee7920b873d26c01cd4aad6c7de1508a84bdf1a893cb527bc8af7d95acc3
Opcode Fuzzy Hash: 6fbcc7404c44bc5d67a7d9daa789b0fadc73064cee8f950fadd7e0d1dcaeca71
Instruction Fuzzy Hash: 1511C2B6A006154FDB14DE798C446FFB7FAFBD8261B144929E429D3340EF30990287A1

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6440, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90580030912566213deaba93ccdeab933440941195c87f7d095a41378779109
Instruction ID: 764f1529cab95f9ab82daf434a287000f7f38f9a30f253d99c8efd7f0d061f3c
Opcode Fuzzy Hash: e90580030912566213deaba93ccdeab933440941195c87f7d095a41378779109
Instruction Fuzzy Hash: 4F114831B0025A8F8B54EBB899105EEB7B6AFD9215B10407AD504ABB41EF329D16CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0112D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225912613.000000000112D000.00000040.00000001.sdmp, Offset: 0112D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c44e5517e690f366dff050201c0b94941bd0826892d3e316883c0148e970eb9
Instruction ID: 77f9f22f4700990df4c0a80c9f0dc3506f0407ffe4eaa6876e1dc266b417e750
Opcode Fuzzy Hash: 4c44e5517e690f366dff050201c0b94941bd0826892d3e316883c0148e970eb9
Instruction Fuzzy Hash: 8311D376404280CFDF16CF54E5C4B16BF71FB84324F2486A9D8094B61BC33AD46ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08BED458, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1f752c701b6970dce6b30fcd20e35d2f417fb61771373bec483bc84a19f019
Instruction ID: 5fe751f75aa0edd4f88e0cd89d67698afde2d23335c450e26f47bed2366f47e8
Opcode Fuzzy Hash: 2f1f752c701b6970dce6b30fcd20e35d2f417fb61771373bec483bc84a19f019
Instruction Fuzzy Hash: 3B111734E01109EFCB44DFA9C645A9DFBF2EF88300F14C5A9D81997214DB70EA00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0113D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225938375.000000000113D000.00000040.00000001.sdmp, Offset: 0113D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088bb676d9cc58b7b5583b2d12a323ce7eb7cea81b0eb8fe1e3b9802e29bf41a
Instruction ID: 8e9c162b3b2922b86ca10d796b966cbd82be14cbaf1731cc2190bae6e3fb0794
Opcode Fuzzy Hash: 088bb676d9cc58b7b5583b2d12a323ce7eb7cea81b0eb8fe1e3b9802e29bf41a
Instruction Fuzzy Hash: 4311A975904280DFDB16CF54E5C0B15BFA1FB84224F28C6A9D8494B65AC33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0112D771, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225912613.000000000112D000.00000040.00000001.sdmp, Offset: 0112D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e6eadf5995d8753115fbf369b64fc4c98ed1efcf233386f55cb86dbdaf1d52
Instruction ID: 4ac93d19101739e98a864f815704b38c8861d9ea8b4e8dc3b3b36001df0dc370
Opcode Fuzzy Hash: 50e6eadf5995d8753115fbf369b64fc4c98ed1efcf233386f55cb86dbdaf1d52
Instruction Fuzzy Hash: 7501F7710087949AEB285B6AEC84B66FBDCEF4022CF188459EE055B643C37C9844CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 08BE7330, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aac3455c1814d12abcb0b14595a10d2d7fc64e400d0613a6355b5e8d202b29b
Instruction ID: 6805110f63011bc0387d30226b68d2203afe0ad7a7690158780b7828bb035113
Opcode Fuzzy Hash: 0aac3455c1814d12abcb0b14595a10d2d7fc64e400d0613a6355b5e8d202b29b
Instruction Fuzzy Hash: 94111B72D10B0B9ACB51EFA5C9415E9FBB0FF99310F10CA5AD558B7100E770A6D58BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA048, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3dad2a86c7b0701def74182628ed539a58adbfc6bb0a3572803f1098b57471a
Instruction ID: 98fe751d6881a78f1a271b46f13c7551e825b4980b3efbc13b1957f309846bc1
Opcode Fuzzy Hash: d3dad2a86c7b0701def74182628ed539a58adbfc6bb0a3572803f1098b57471a
Instruction Fuzzy Hash: F601F2B0915285DFCB41CF64C10A24EBFE2AB42315F24C0E9D8098F227D7314A569756

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA058, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee80fed208f781eee3d20c59d330e9a8cf0a498910c93d68da724f555e1173e5
Instruction ID: 2a523afa3954bae719042c96a7cf463666d66f40ac2f339869673a3034ea07b9
Opcode Fuzzy Hash: ee80fed208f781eee3d20c59d330e9a8cf0a498910c93d68da724f555e1173e5
Instruction Fuzzy Hash: 29F0F470911208EFC744DFB4D54928DFBBAEB98302F20C0A5E409D3265EB304E44DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0112D770, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.225912613.000000000112D000.00000040.00000001.sdmp, Offset: 0112D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a146569955cfb480c3e1aa38b14915c728fd068d231e72db5a29a93b8a9c62
Instruction ID: 42471387ea53ef165e6cb968ce0ae0a77de0601b3f0377a4ef2f895ef312b6f7
Opcode Fuzzy Hash: 41a146569955cfb480c3e1aa38b14915c728fd068d231e72db5a29a93b8a9c62
Instruction Fuzzy Hash: 99F0C8714046849EEB158A1ADC84B62FFD8EB41634F18C05AED080B682C3785844CA71

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6E8D, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45db42e77c7db41fecb4a25f845d5fa2ef4779e2f8b6895ce40e9d5bd071a4b2
Instruction ID: 69229723f7387e934d7ab0c33c2b5348e69b13a8c3810fc22fe3ff67209c499c
Opcode Fuzzy Hash: 45db42e77c7db41fecb4a25f845d5fa2ef4779e2f8b6895ce40e9d5bd071a4b2
Instruction Fuzzy Hash: 31010870800259DFDF24CFAAC5443EE7BB1EF55325F248669E824AA6A0D7744A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6E98, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bc2baf0ffd546ffee7a5ebacf57607f479a4185c91ba1754218eb844de5e6a
Instruction ID: 836797e33301e89993a0de62fc051065c73b5b619e14c39ed9cd48efba98bf36
Opcode Fuzzy Hash: 11bc2baf0ffd546ffee7a5ebacf57607f479a4185c91ba1754218eb844de5e6a
Instruction Fuzzy Hash: 8A01E870800219DFDF24CF6AC4083AEBBF1FF59355F208669E824AA2A0D7744A44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6F28, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76257cb2f6d70c2fdcd7a5366df769f6c1e0a9938ebab851fbcad925fe0a8a4e
Instruction ID: 8b6df970a6e36217bcc2f99adb73c68993357f7defeb3c3f36e5bba67d505ca3
Opcode Fuzzy Hash: 76257cb2f6d70c2fdcd7a5366df769f6c1e0a9938ebab851fbcad925fe0a8a4e
Instruction Fuzzy Hash: CFF0E2767042245FD304C7ADA884D6BBBE9EFCD224B158479E558C7350DA308C02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 08BE63B8, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896ad54d050feec97a542de307595b9150960c4b9cb6b74f51ea4c16c74e4abe
Instruction ID: 1594b15daa17346d9edf29fb3df5d989ff32a4ae59cfee75ccc03fd0f1a33d96
Opcode Fuzzy Hash: 896ad54d050feec97a542de307595b9150960c4b9cb6b74f51ea4c16c74e4abe
Instruction Fuzzy Hash: 38F0AF75E09348DFC705DF68D994A9DBFB4EB5A205F0485EAE844A7322C730D904DF62

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6F38, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902f019a4261c401aac69149f73bdc90750e776bda54f670c69f0ef9f99ad45e
Instruction ID: 929d447329a89566448db25ce1c277b86850ca5c0a90ce0429b74393e0a50115
Opcode Fuzzy Hash: 902f019a4261c401aac69149f73bdc90750e776bda54f670c69f0ef9f99ad45e
Instruction Fuzzy Hash: CFE039727042286F5304DA6ED884C6BBBEEEBCD664351813AF508C7310DE319C01C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA388, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ee754939c2a650b155b734b4ad0a21bf4b5402a09d656273548d19cc6f9274
Instruction ID: 73ee4aa6728b9ca0260d5ed8cdb2118b4a0bbc6dad3352d6450b35e34fdb2e9c
Opcode Fuzzy Hash: f0ee754939c2a650b155b734b4ad0a21bf4b5402a09d656273548d19cc6f9274
Instruction Fuzzy Hash: 0901D670A056298FDB64EF64D954F9DB7B2BF89204F1086D9E00DA7760DB30AE84CF25

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6F80, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8d3e9c1a8a8ce9a1c071d017c8200a8b536577c17cf38a01ae074893fe174e
Instruction ID: 9ec42cd43b3106665c09127393daaec157b5b87fcb63f1912d51bd58f2a4235e
Opcode Fuzzy Hash: 4f8d3e9c1a8a8ce9a1c071d017c8200a8b536577c17cf38a01ae074893fe174e
Instruction Fuzzy Hash: 3CE0863A7505006FC3149749DC89FC6BBA9EFD9761F45C026F609C7761DA60DC128A94

Uniqueness

Uniqueness Score: -1.00%

Function 08BE9FF8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaeb58e7662a9042e3d94d38c51a5607b2e43505e020f47d895ea5856ed4662
Instruction ID: 2591e6946ea9cfd8254b68beb91260679249323009de216bd39fc415f41116d6
Opcode Fuzzy Hash: 4eaeb58e7662a9042e3d94d38c51a5607b2e43505e020f47d895ea5856ed4662
Instruction Fuzzy Hash: 3EF0EDB1C00309AFCB21CEA4D4406EDBBF8FB25312F1081D9EC14263A2E7314A86EB81

Uniqueness

Uniqueness Score: -1.00%

Function 08BE5E82, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0dfaf8c8177fbd93f442b70bbe2ea2a42518a7d360fd7d0eede35b23d19289b
Instruction ID: ae6797856b545e55265a77f81128e0d113b86ae1f3eb71eda820bdb0949d836a
Opcode Fuzzy Hash: f0dfaf8c8177fbd93f442b70bbe2ea2a42518a7d360fd7d0eede35b23d19289b
Instruction Fuzzy Hash: 27E01A75825208EFDB54DBB8D88A7DDBFB8EB04206F1445E9E909A2241EB309A40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 08BE8130, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ee8a3378462309476fb88ecb9a5585f5ab2d86aef2dbb5628cb59d305da1a3
Instruction ID: 2ad13fa5361fc901460f4e310954b0f3567e7ef1a5061615e33d5bd410c890c4
Opcode Fuzzy Hash: 01ee8a3378462309476fb88ecb9a5585f5ab2d86aef2dbb5628cb59d305da1a3
Instruction Fuzzy Hash: 4EE0487095A3489FCB40DFF498816DD7FB89B49206F5144EAD904D3351E7704A54DB52

Uniqueness

Uniqueness Score: -1.00%

Function 08BE8B6A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034208abd01ef5fb8cc6121cfd0ee93ffee9f6eaa0f206e9c729f58ef20f2294
Instruction ID: 0db8f42553953d75b0fc0350505d9c6f035d09e78b41b3ad7db7c0ebd9b5b5ee
Opcode Fuzzy Hash: 034208abd01ef5fb8cc6121cfd0ee93ffee9f6eaa0f206e9c729f58ef20f2294
Instruction Fuzzy Hash: 03E01A74921608EFC780DFA8D489ADCBBF8EB08215F1440E9E80893321E7319A40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA008, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0e39ce3419303b83d00ec44634f70b5bd8ff5e3a65a657fe121095be5ae5e8
Instruction ID: 212fabc0105f65bc67356ce23dbf72b329e6fb787a6543b8e92c67220af570d8
Opcode Fuzzy Hash: 9b0e39ce3419303b83d00ec44634f70b5bd8ff5e3a65a657fe121095be5ae5e8
Instruction Fuzzy Hash: 20E0E570D05308EFCB15DFA8D4406DDBBB8EB58301F1084A9E804A2311EB359A90DF91

Uniqueness

Uniqueness Score: -1.00%

Function 08BE8B70, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a03faf89d9edd76c19185fa8f1ddfc4cce22c015c587113f5caf02e2da09ba
Instruction ID: 9a8d93e882bae8192e5b35316854e11b2afb18d7c22dab02d2de4b38cd171d16
Opcode Fuzzy Hash: d5a03faf89d9edd76c19185fa8f1ddfc4cce22c015c587113f5caf02e2da09ba
Instruction Fuzzy Hash: 2EE0BF74925608DFC744DFB8D545A9CBBF8EB08615F1444E9E80997361D7319A40DB41

Uniqueness

Uniqueness Score: -1.00%

Function 08BE5E90, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d00885e564d734e1695be32b1ea9f4c9cfedda963664ecb4ce6fa9e4152b2f
Instruction ID: d9e2047390a71a8eea7f119c605a9e133726be2fde4f32864c2343d8d9f0dfb4
Opcode Fuzzy Hash: 89d00885e564d734e1695be32b1ea9f4c9cfedda963664ecb4ce6fa9e4152b2f
Instruction Fuzzy Hash: 73E0EC34915208DFCB54EFB8D5466DDBFB8EB04206F1045E9E809A3255EB305A80DB41

Uniqueness

Uniqueness Score: -1.00%

Function 08BE6F90, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600007b9860116d1b28d8384162eb0263383ed23bc50dc64df3ab84a60d0f262
Instruction ID: e7ce33a869e07b3b84a1a8d82dc189be0bc724189ccc6b259602a3de1bd18316
Opcode Fuzzy Hash: 600007b9860116d1b28d8384162eb0263383ed23bc50dc64df3ab84a60d0f262
Instruction Fuzzy Hash: 95D0123A300514AFC3149A4AD804D86BBA9EFD9721B158066F60AC7360CA71EC11C694

Uniqueness

Uniqueness Score: -1.00%

Function 08BE8140, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f009518561bc68af71b2b974f353bb4a9986dc2665c76b9036bf992bd689ea
Instruction ID: 6affb1b44dd5afbef0a0e500092da40a3beb9023bf0bc98ac1a9de4c424d30dc
Opcode Fuzzy Hash: d6f009518561bc68af71b2b974f353bb4a9986dc2665c76b9036bf992bd689ea
Instruction Fuzzy Hash: 99E0EC709252089FCB44EFA895456DEBFB8AB49205F1044E99809A3355EB305A54DA92

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA6DC, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67905d763e09dd1eac92b340836a617b342cf37196b83ee68280dd0c3563e88
Instruction ID: 923b045a03e5d2648ee6ab07bb67b259ebf33221acc9f5d183ade8612eef0504
Opcode Fuzzy Hash: b67905d763e09dd1eac92b340836a617b342cf37196b83ee68280dd0c3563e88
Instruction Fuzzy Hash: 33E04F74809229DFCB50DF95D54029EFBB6FF59302F11A4D6E019BA214D331DA429F52

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA66F, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72dbe337e7c2faac19fd3c87fd7564a9a89143ce5ec56686744e23801a45da9
Instruction ID: 60ad9deba3c4631917aea2eff02cbb4630d1190ee809296d9afdebb01916f2aa
Opcode Fuzzy Hash: b72dbe337e7c2faac19fd3c87fd7564a9a89143ce5ec56686744e23801a45da9
Instruction Fuzzy Hash: F3D01770E092289BDB54CBA8C58028EB7B3FB99341F10D0A6D028BA208D330CE85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 08BE640A, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f80762aa3d344cf79bbbf2443c792b52ee53a1d5ef24d8f824208d8b14bea63
Instruction ID: 75f9d84256a0d829abf54359fb245b7da2bcab08db910248c077c95fb0d08b40
Opcode Fuzzy Hash: 0f80762aa3d344cf79bbbf2443c792b52ee53a1d5ef24d8f824208d8b14bea63
Instruction Fuzzy Hash: 70C08C3A2100009AD309AB40D945F42B592FFC4318F45C12880006A130C62AC028DF66

Uniqueness

Uniqueness Score: -1.00%

Function 08BEC1F3, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c22ad0ed2dd837bfe61fac2f17fde4aa8d08953cbc013971f592bf907a4e78
Instruction ID: 4dc2c6cea54ea313b2f63b8b48b446ab317581220020bbc8239f7117c32a2439
Opcode Fuzzy Hash: 52c22ad0ed2dd837bfe61fac2f17fde4aa8d08953cbc013971f592bf907a4e78
Instruction Fuzzy Hash: 7DC08C30814249CF8708CBD0C5C589DFB70FF49302F108C28E007BA069DB38D900CE10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07274158, Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

:=C, xrefs: 07274287
r!, xrefs: 072742CC

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID: :=C$r!
API String ID: 0-1672146102
Opcode ID: d60432da8720ef01e5f9f517b8e6cf1dce423e38af9b9c6f3c1e16a82c20c481
Instruction ID: 3799c7f4065162bca94cfb8883c68729eac37b0c27ff28dbd8c8c16cfa6338dc
Opcode Fuzzy Hash: d60432da8720ef01e5f9f517b8e6cf1dce423e38af9b9c6f3c1e16a82c20c481
Instruction Fuzzy Hash: 48B125B4E212598FCB04EFA9CA855DEFBF6AF89300F24D526D405AB214E7349942CB64

Uniqueness

Uniqueness Score: -1.00%

Function 07274148, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

:=C, xrefs: 07274287
r!, xrefs: 072742CC

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID: :=C$r!
API String ID: 0-1672146102
Opcode ID: bca872a084bcba9a574edc30f1aec0d95be0b2ec33f11d05023cdd822da022bb
Instruction ID: 8780bbba944242f7cf3daa48e64d63890822acf4acb105a7d6913dad0376dc3b
Opcode Fuzzy Hash: bca872a084bcba9a574edc30f1aec0d95be0b2ec33f11d05023cdd822da022bb
Instruction Fuzzy Hash: 2CA127B4E252498FCB04EFA9CA855DEFBF2BF89300F24D526D405AB214E7349942CB64

Uniqueness

Uniqueness Score: -1.00%

Function 072731C0, Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

7\j, xrefs: 072732A7
73, xrefs: 072732AA

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID: 7\j$73
API String ID: 0-2890993049
Opcode ID: 02a3013878df917a3749bb7c477d3fa50058812199cc5c30c7e89691006c7391
Instruction ID: 7ed7ad0177436d199b592c6f6b5f4fa9452f3c31a933ed41c48fa4c9b1d109da
Opcode Fuzzy Hash: 02a3013878df917a3749bb7c477d3fa50058812199cc5c30c7e89691006c7391
Instruction Fuzzy Hash: F331F772D10655DBDB19CF79E9066DEFFF6AF89220F18C067D404AB211DB340991CB92

Uniqueness

Uniqueness Score: -1.00%

Function 08BEEED8, Relevance: 2.6, Strings: 2, Instructions: 107COMMON

Download Yara Rule

Strings

(, xrefs: 08BEEF90
(, xrefs: 08BEEF97

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID: ($(
API String ID: 0-222463766
Opcode ID: bf821a751188811a107e5836a8b3eebbefc1aec8267741a4cec3e41ace92e2bc
Instruction ID: ae87dfa031b149c7b41b82ac5ba74cb3e88200fc3543e3a8d852c9c049fc9a65
Opcode Fuzzy Hash: bf821a751188811a107e5836a8b3eebbefc1aec8267741a4cec3e41ace92e2bc
Instruction Fuzzy Hash: 2141D3B0E0460A9FDB48CFAAD5405AEFBB2FF88311F24D46AE415A7254D7349A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 08BE0040, Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

-, xrefs: 08BE4114

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: fd8392243623ec2bc0a1c15b01ea100be5348077caab48b92232e92179329d86
Instruction ID: b34d0d84584af8d4a3eff0655fe1f7d09a7ce07964b7c41980baee5db63e3ee1
Opcode Fuzzy Hash: fd8392243623ec2bc0a1c15b01ea100be5348077caab48b92232e92179329d86
Instruction Fuzzy Hash: 7641FC71E156588BEB5DCF6B9C4078AFAF7BFC9201F14C1BA940CAA259DB7006868F11

Uniqueness

Uniqueness Score: -1.00%

Function 0727E3B8, Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d987ef2d3cc4e1c8b0b795b83e89f668c7a4d54e5c1f0e79bdaac243fe3fb66a
Instruction ID: 6abc8d48b141dbaa062264a69a1f92fa88f0a4d0c9fb5b48e0f8584d61b1d6b2
Opcode Fuzzy Hash: d987ef2d3cc4e1c8b0b795b83e89f668c7a4d54e5c1f0e79bdaac243fe3fb66a
Instruction Fuzzy Hash: 2EE1BEB0B102068FEB19DB76C560BAEB7E6AF89704F1588EDD545CB290DF34E805CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08BE74A0, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e33895b915f308ea36c431d6619861df70b4c417647ded62326c0adc1ea2da
Instruction ID: e62877a07b0446a569ccc8d45be2f9e7000efec878276a56baa03d058f476360
Opcode Fuzzy Hash: 26e33895b915f308ea36c431d6619861df70b4c417647ded62326c0adc1ea2da
Instruction Fuzzy Hash: 53F12A31D2075A8BCB10EF64C990ADDB7B5FF95204F508B9AE10A77224FB706A94CF61

Uniqueness

Uniqueness Score: -1.00%

Function 072738A0, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c08d77ea90463fd4ecb0a032994e211a376199f5365f0a34aa5bdb55f66b98
Instruction ID: fffb97df99b75eb0ab3f616294e84dc5524bf9adf1ab792ab03bb249f9f0f283
Opcode Fuzzy Hash: d1c08d77ea90463fd4ecb0a032994e211a376199f5365f0a34aa5bdb55f66b98
Instruction Fuzzy Hash: 3BC13CB4E14159CBCB14DFA9CA909AEFBF6FF89304F248199D408A7316DB309942DF61

Uniqueness

Uniqueness Score: -1.00%

Function 07273889, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcda5c4be5bc617e42974a13277822ae73b276769454f49b1ce6684db331602c
Instruction ID: 8df2c979c668ea105ee79465913c8519c47ffd05f0ced2bf21ff88639f6fb1e2
Opcode Fuzzy Hash: fcda5c4be5bc617e42974a13277822ae73b276769454f49b1ce6684db331602c
Instruction Fuzzy Hash: 8BC14CB0E14259CFCB14DFA9CA919AEFBB6FF89304F248199D404A7316DB309A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08BE74B0, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04dda4d8049276e674a5b8b8c1641d31381f0d3915b5850769507beebc483bd7
Instruction ID: ffb99737916aca7be3c3ae1c739c70cfeee20a71e6aae8c447efc6e00893f8ca
Opcode Fuzzy Hash: 04dda4d8049276e674a5b8b8c1641d31381f0d3915b5850769507beebc483bd7
Instruction Fuzzy Hash: E2D1D530D2175A8ACB10EF64C990ADDB7B5FF95204F508B9AE10A77224FB706AD4CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08BEDC80, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed9635e704b223cbf90696a51258b4118f836c0d449561ec40d1fc0588408b2
Instruction ID: 82d4ed78484cbc64139aa1b1adc85e6cb6e81faf9640a9182d67f94e5919ab79
Opcode Fuzzy Hash: 9ed9635e704b223cbf90696a51258b4118f836c0d449561ec40d1fc0588408b2
Instruction Fuzzy Hash: 5281E274E15219CFCB44CFA9C584A9EFBF2FF88251F2485A9E415AB314D374AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08BEF0F8, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e8544f20d9b024e261a6ce8268cb7ed3c170b30ff259e7b3f7eee16355486e
Instruction ID: 6b2b68bc2f2dce1c3610a257bb37aed6e16a85ab5a4f4e0fcde1878778b45306
Opcode Fuzzy Hash: 25e8544f20d9b024e261a6ce8268cb7ed3c170b30ff259e7b3f7eee16355486e
Instruction Fuzzy Hash: 4E61D570E05609CFCB04CFAAC5804EEFBF2FB88311F2495AAE415B7314D7309A418B65

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB948, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c651ff42930c88f751df0293750adf0c7765b2b6b59b6c55a52caf95534ee413
Instruction ID: 6abb19b68d1f3bde06bed1f4926688ab6301298354d2e1f0f0c073c29b4e8791
Opcode Fuzzy Hash: c651ff42930c88f751df0293750adf0c7765b2b6b59b6c55a52caf95534ee413
Instruction Fuzzy Hash: 066104B4E0520ADFCB04CF99D580AAEFBB2FB98321F149569E515BB314C7349A81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0727A3B0, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c57fda71f78ffd66321f7dd87cb82c52be02b30926a96fe483c9ec3e75a301
Instruction ID: 2ded06d7dd711ffd0e9a5854b7ac23aa3ecb86f607c73acffe0d0c6440155eaa
Opcode Fuzzy Hash: 27c57fda71f78ffd66321f7dd87cb82c52be02b30926a96fe483c9ec3e75a301
Instruction Fuzzy Hash: 82612AB1D2466ACBDB28CF66C9447DDB6B6FFC9300F14C5AAC50DA6214EB704A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08BEE840, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a28765f6085ebf7a9724859953a0dadaf4342a610d92f1c824ed9a2f3a6bcd
Instruction ID: 0f0a3430efada162a9f1b9c9fb6dbd3a9faa07c2ee03c60e355c7da108c48b61
Opcode Fuzzy Hash: d8a28765f6085ebf7a9724859953a0dadaf4342a610d92f1c824ed9a2f3a6bcd
Instruction Fuzzy Hash: 0F61B174E05219DFCB44CFD9D5819AEFBF2FB48311F24959AE409AB315C730E9428BA4

Uniqueness

Uniqueness Score: -1.00%

Function 08BEB939, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b0646b1484402a935d9a1fe964c66bd98a704e14a687749f9e971d5dfe5b4b
Instruction ID: 7b7b6a74efe34467b17cfd1cbc2923f4f2df17029cdbe6b1479ae3079e09cfb1
Opcode Fuzzy Hash: 54b0646b1484402a935d9a1fe964c66bd98a704e14a687749f9e971d5dfe5b4b
Instruction Fuzzy Hash: 2061F4B4E0520ADFCB04CF99D581AAEFBB2FB88321F14956AE505B7314C7349A81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08BEEB30, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11468a1c186dc1eb1f2f287ac87e6e5f6a7816a73d531d075c09b5232b596ff9
Instruction ID: 65897d87a0dcf5504e1f9a592ded51bbdce2274854651ed940cc4b173af6ca61
Opcode Fuzzy Hash: 11468a1c186dc1eb1f2f287ac87e6e5f6a7816a73d531d075c09b5232b596ff9
Instruction Fuzzy Hash: 8D61E4B4E046099FCB04CFAAC4819AEBBB1FF48241F14859AE516B7314D774AA42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA0F0, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3511ef9f576e21f05848f2dd3cdcc1ce698871414420a43dad427ec93bb42d3
Instruction ID: 8d8aeed7e3f7a810d19b4910f955ced3db592f1cf50fdd9888d578607aab95da
Opcode Fuzzy Hash: d3511ef9f576e21f05848f2dd3cdcc1ce698871414420a43dad427ec93bb42d3
Instruction Fuzzy Hash: E151C770A01228CFDB54CFAAC944A8EFBF7FF89205F14C5A9D508AB215DB309A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08BEA0E1, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68abbf046e6aa52404147c2704dc43b2c3fd72f59700b2c5658e5d19c2b5a66a
Instruction ID: 2f52219a2ae7408fbe21dcb26c1aac4cee79acec31bc67a19ca42dee57ecf16b
Opcode Fuzzy Hash: 68abbf046e6aa52404147c2704dc43b2c3fd72f59700b2c5658e5d19c2b5a66a
Instruction Fuzzy Hash: 4D51B5B4E00228CFDB54CFA6C944A8EFBF7FF89605F14C5A9D508AB215DB309A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 07274928, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ccce307a0c11c3dca5e86d86e3b2fcb3a36538fa96216d2a3c1143e4eba32f
Instruction ID: 46dac4f8b85331c2a975d4e28e6485b20cf98aab7362cdc3cedb24a320d16a31
Opcode Fuzzy Hash: 37ccce307a0c11c3dca5e86d86e3b2fcb3a36538fa96216d2a3c1143e4eba32f
Instruction Fuzzy Hash: 085150B0E11119DBDB04DF6ADA8099EFBB7FFC9204F24C1AAD508A7245DB305A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07274919, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136aa2b7c6e77545644ca378efcc0d225b4c0c2be871f59e15a24516144d9563
Instruction ID: 2158e8395fea70cf6d8876b067af6ec7dd63a131d3e814e6da2cf2239b855893
Opcode Fuzzy Hash: 136aa2b7c6e77545644ca378efcc0d225b4c0c2be871f59e15a24516144d9563
Instruction Fuzzy Hash: 0A5170B0E11159DBDB14DF6ACA80A9EFBF7BF89204F24C5A9D408A7349DB305A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07275CE0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33681e970e5d2a34f94c0a94130d8c119914895c5f58ceabf497365ef18222da
Instruction ID: f046dbbe2de1dc6ded0d6ef8cc8089b1096c2bcd96d9ce3f6b012ddaa7e802fb
Opcode Fuzzy Hash: 33681e970e5d2a34f94c0a94130d8c119914895c5f58ceabf497365ef18222da
Instruction Fuzzy Hash: CE4164B4E115199BDB14CFAACA805AEFBF7FF89304F24C1A9D408A7205DB305A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07275CD2, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1c87d7b2933a23025443bb6a9ba75aefd3c2e5964b93acdb37d8bce8b2f8ee
Instruction ID: 8b2a56a9f3ea09730344c54c230f071d95544e10c39c4cf598ca0f61da9b652f
Opcode Fuzzy Hash: 2c1c87d7b2933a23025443bb6a9ba75aefd3c2e5964b93acdb37d8bce8b2f8ee
Instruction Fuzzy Hash: 2B4160B4D115199BDB14CF6ACA815AEFBF7FF89204F24C5A9C408A7205DB309A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07270040, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a114867c3123d7d5d17f54eebdffab2ddf037fceb36dfa37b4727439168f98e3
Instruction ID: e3cc3ec472753689a3e7f85b0fb0ee3ec67424cafb1f518e1502d9b9337f8a24
Opcode Fuzzy Hash: a114867c3123d7d5d17f54eebdffab2ddf037fceb36dfa37b4727439168f98e3
Instruction Fuzzy Hash: 85414FB1E116198BDB68CF6B8D4469EFBF7BFC9300F14C1B9950CA6214EB3409858E11

Uniqueness

Uniqueness Score: -1.00%

Function 08BE0039, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834d6d91d030913f7cc95d4e5d677803e0f976e619f078f858f75fd6dcb95ea9
Instruction ID: 54c1c1ec1ee61acd33edc871d83bcfca2fa5c8664fdd256d79d979e642860a13
Opcode Fuzzy Hash: 834d6d91d030913f7cc95d4e5d677803e0f976e619f078f858f75fd6dcb95ea9
Instruction Fuzzy Hash: 72410E71E156588BEB5DCF6B9C4178AFAF7BFC9200F14C1BA940CAA259DB7006868F11

Uniqueness

Uniqueness Score: -1.00%

Function 07270039, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d05358948bc96bab9c15799dd6524ab6a7ca71b1cf749992025464f82b945c2
Instruction ID: 429230475cdc25e577b343cfbede0b6ddc994ca45f5d5c643ec496efd93ca946
Opcode Fuzzy Hash: 6d05358948bc96bab9c15799dd6524ab6a7ca71b1cf749992025464f82b945c2
Instruction Fuzzy Hash: A6413DB1E116188BEB58CF6B8D4579EFAF3BFC8301F14C1BA994CA6214EB3409858F11

Uniqueness

Uniqueness Score: -1.00%

Function 08BEF358, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239171737.0000000008BE0000.00000040.00000001.sdmp, Offset: 08BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3911d90db2e670acad20fc70ac554ccb8631e642cdc9f98aedbdafd8f7c3e005
Instruction ID: c49a261dd061f212e6451173345abc226b0468bf375bbebe52db8d388ee9b047
Opcode Fuzzy Hash: 3911d90db2e670acad20fc70ac554ccb8631e642cdc9f98aedbdafd8f7c3e005
Instruction Fuzzy Hash: 7741B4B4E0560ADFCB04CFAAC5815EEFBB2FB88301F24D5AAD515B7354DB309A418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0727A39F, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d104f41950394177e5d34f96815097b4d4f99b01abc46c41597bfcb2003c3f0
Instruction ID: 38fea1fafe75db6adb5f3378436f1afc569f4a99c8852e3a715e491d20b2604b
Opcode Fuzzy Hash: 4d104f41950394177e5d34f96815097b4d4f99b01abc46c41597bfcb2003c3f0
Instruction Fuzzy Hash: C4311AB1D14669CBDB28CF6B890439EBAB7ABC9301F04C1BAC50DB7214DB304A86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0727EBD8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.236993275.0000000007270000.00000040.00000001.sdmp, Offset: 07270000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d3542e9b122842d0b06bf2e1ec7e4be49f96812ed246ed1dee13c6e40b8685
Instruction ID: fd7623eac49cdba97e63564a0836ad84fc018fe75cf85aa8c4c4dcf7ab2e0dfd
Opcode Fuzzy Hash: 06d3542e9b122842d0b06bf2e1ec7e4be49f96812ed246ed1dee13c6e40b8685
Instruction Fuzzy Hash: EB21AEB4D15249CFDB15DFA4C605AEDBBF1AF4A300F0A84AAD415BB2A1C7348984CB75

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Scan copy.exe PID: 5988 Parent PID: 6048 Scan copy.exeCOMMON

Executed Functions

Function 01532B08, Relevance: 2.3, APIs: 1, Instructions: 760libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01533290

Memory Dump Source

Source File: 00000007.00000002.472166422.0000000001530000.00000040.00000001.sdmp, Offset: 01530000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9a0565923319cb80223c0e32c1d185e0cae62bb6b3da9affc929d08c0f21e681
Instruction ID: 82281723cfa2c61118d6ecce2058007c19d9ef6708a785b2ce04ed9d4999066e
Opcode Fuzzy Hash: 9a0565923319cb80223c0e32c1d185e0cae62bb6b3da9affc929d08c0f21e681
Instruction Fuzzy Hash: 2E62F671E006198FCB64EF78C8546DDB7B2BF89304F1085A9D54AAB760EF30AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 015388B0, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015388F1

Memory Dump Source

Source File: 00000007.00000002.472166422.0000000001530000.00000040.00000001.sdmp, Offset: 01530000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89387933c718dbc8c7741ef932944af26fedc1c9237d9a655c0cac49aa9c66a6
Instruction ID: 31cd36fe2285db0bd0772c8eed503ffb8f1cfdec649017fd0ee821e3f1d2657c
Opcode Fuzzy Hash: 89387933c718dbc8c7741ef932944af26fedc1c9237d9a655c0cac49aa9c66a6
Instruction Fuzzy Hash: EF614A30A102069FDF18EFB5D5587AEBBF2BF88305F108928E512AB354EF799845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 011C05C8, Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 011C23C3

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 283c0c5bb694e3a4bbc0d20f27c29a6149ed91bd774732302d21983f88c73539
Instruction ID: c30c40471ace4cf39d7dae23a57e04cbe00f36b14e6bb7cad9e60e24bf0583b2
Opcode Fuzzy Hash: 283c0c5bb694e3a4bbc0d20f27c29a6149ed91bd774732302d21983f88c73539
Instruction Fuzzy Hash: FC2135759042088FCB14DF9AD844BEEBBF5FB88324F10842AE415B7750CB74A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01540A70, Relevance: 7.0, APIs: 4, Instructions: 976libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01540C43
KiUserExceptionDispatcher.NTDLL ref: 0154112D

Memory Dump Source

Source File: 00000007.00000002.472225092.0000000001540000.00000040.00000001.sdmp, Offset: 01540000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9d647f8437367f94f2ed964e55bfc0558f86b5b922732cee978d43f9cca0d792
Instruction ID: 681f41f58e4b2b777169f9f79a6bef79356e0cd82ddb36d89ed07a908327fcdd
Opcode Fuzzy Hash: 9d647f8437367f94f2ed964e55bfc0558f86b5b922732cee978d43f9cca0d792
Instruction Fuzzy Hash: B7A23B74A00229CFCB64EF60D8986ADB7B6BF88309F1084E9D54AA7354DF349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011CD408, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 453libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?), ref: 011CD92A

Strings

P, xrefs: 011CD5DB
K, xrefs: 011CD5E8

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: K$P
API String ID: 1029625771-420285281
Opcode ID: 10e85a30d1331ecc3eb8dbdbc37e8cf9e5f9b2d9421737f7a6e098840356ef68
Instruction ID: da4fa99add80f6770e1b89fcc78f30a948bb3b911e99217f581193fce8d03127
Opcode Fuzzy Hash: 10e85a30d1331ecc3eb8dbdbc37e8cf9e5f9b2d9421737f7a6e098840356ef68
Instruction Fuzzy Hash: 86F15E74B002008FDF24CBA8D484BADB7A1EB59B14F54846DE64ADB7A2C775EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0154114E, Relevance: 3.4, APIs: 2, Instructions: 402COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 015414ED
KiUserExceptionDispatcher.NTDLL ref: 01541923

Memory Dump Source

Source File: 00000007.00000002.472225092.0000000001540000.00000040.00000001.sdmp, Offset: 01540000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8a166315363996ccc10c220668fc930d796f3f3a72b7169807fe998c64a84fd1
Instruction ID: 69db79a0768a7aeb05e5f6d921a2c13d6f01032ac35e5351cf3b473eb7f6c353
Opcode Fuzzy Hash: 8a166315363996ccc10c220668fc930d796f3f3a72b7169807fe998c64a84fd1
Instruction Fuzzy Hash: D8123EB4A01219CFCB65EF20D9986ACB7B6BF88209F1084E9D609A7340DF349EC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01541556, Relevance: 1.8, APIs: 1, Instructions: 297COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01541923

Memory Dump Source

Source File: 00000007.00000002.472225092.0000000001540000.00000040.00000001.sdmp, Offset: 01540000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 094eaa0804b71ebde3c40ffbf6fd5325e596a13a8cb0df62d18fcc1922d13c77
Instruction ID: 4bc89dae0880204828c3e709cd804c330a4cc0cf7e220c3943f8b8c7de5fd869
Opcode Fuzzy Hash: 094eaa0804b71ebde3c40ffbf6fd5325e596a13a8cb0df62d18fcc1922d13c77
Instruction Fuzzy Hash: 84D11DB4A00219CFCB64EF60D8986ADB7B6BF88209F5084E9D60AA7341DF349DC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01493D50, Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01494116

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 84568485455140b89cc7497807c726c18d8db437919111a86cdf5607bbc97685
Instruction ID: f39d6826963f69fc19a8245e68388a31603f0019cd6c5df769c2b73a9a505655
Opcode Fuzzy Hash: 84568485455140b89cc7497807c726c18d8db437919111a86cdf5607bbc97685
Instruction Fuzzy Hash: 3FB17C74A006019FCB14EF79C49466EBBF2FF89208B10896ED50ADB765DF74EC068B90

Uniqueness

Uniqueness Score: -1.00%

Function 01493574, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014951A2

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2077910140055093a7227e8173482d4ef49fd12e96bec94446e1664a50c74afe
Instruction ID: 9492f67bc6f20736586efb05d1a556d62a8a1424d7559da9f7ed286669425084
Opcode Fuzzy Hash: 2077910140055093a7227e8173482d4ef49fd12e96bec94446e1664a50c74afe
Instruction Fuzzy Hash: 8451BFB1D003489FDF15CFA9C884ADEBFB5BF48314F64812AE819AB220D7759885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01495084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014951A2

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 97715cf9907e531927cfc579360d06d9e42212cb6a42d0c5b0db2376732e980d
Instruction ID: b042c6a265bcda6c4e73a5feb855f6ee32bca681c64a193544bae42e63c2d807
Opcode Fuzzy Hash: 97715cf9907e531927cfc579360d06d9e42212cb6a42d0c5b0db2376732e980d
Instruction Fuzzy Hash: 2951CDB1D003099FDF15CFA9C885ADEBFB5BF48314F64812AE819AB220D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0149779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01497F11

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f8997267364fcda39a1ec7e8791172c6c1b51e4b962f08ddfb039a761124435f
Instruction ID: 47d19862a4536cf6500b7b7878c9bde9b04aeaa851a444fe9ca0591d428e0bdd
Opcode Fuzzy Hash: f8997267364fcda39a1ec7e8791172c6c1b51e4b962f08ddfb039a761124435f
Instruction Fuzzy Hash: 004129B49103058FDB14CF99C488BAABBF5FB88325F248499E519A7321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01538851, Relevance: 1.6, APIs: 1, Instructions: 85libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015388F1

Memory Dump Source

Source File: 00000007.00000002.472166422.0000000001530000.00000040.00000001.sdmp, Offset: 01530000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f22f8c50377f32e8afa4221fc679810e44e87fc51433c928edab15030826567b
Instruction ID: a32f67dbc4a15a78012f95e08eadd49237b92981bca63ca85a3288fa5de83571
Opcode Fuzzy Hash: f22f8c50377f32e8afa4221fc679810e44e87fc51433c928edab15030826567b
Instruction Fuzzy Hash: 79319C30A003459FDB19DFA8D854ADEBBB1FF89314F208969E001AB391DB399846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0149C1A9, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0149C232

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: c32238ec6a215dfc89639ad06b18bff65dbd2c4ecd4bb7e509e3ceaf01e28e2e
Instruction ID: 2066670dda8dfd3125f513a40eb2e887a0893d0ef71f54f3810c33010c9960f8
Opcode Fuzzy Hash: c32238ec6a215dfc89639ad06b18bff65dbd2c4ecd4bb7e509e3ceaf01e28e2e
Instruction Fuzzy Hash: DA31E2B18053858FDB10EFA9E94979E7FF0EB45324F14815BE489A7752CB396408CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0149651C, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01496B2E,?,?,?,?,?), ref: 01496BEF

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 21249f4c37ebc0e9600b03ea55102b916cbe354f654c2d62cb7bfb0faa83ac0e
Instruction ID: 0af10723bd6ac9fb4d995190ab3602caa406a3a0326b384b7c3782a2c074ae7d
Opcode Fuzzy Hash: 21249f4c37ebc0e9600b03ea55102b916cbe354f654c2d62cb7bfb0faa83ac0e
Instruction Fuzzy Hash: 8C21D2B5D002589FDB10DFAAD984AEEBFF8EB48324F15841AE915A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01496B61, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01496B2E,?,?,?,?,?), ref: 01496BEF

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1e6a18bf19517c26cdb7644045797d3fa8e5d6ec6b0cb2383dde0ad87c71eb46
Instruction ID: a7dc680ec5bfeaa80bd3ba7554c01f000d896463a4c8ea2c3fe4d85f2436bf76
Opcode Fuzzy Hash: 1e6a18bf19517c26cdb7644045797d3fa8e5d6ec6b0cb2383dde0ad87c71eb46
Instruction Fuzzy Hash: 6521C0B59002489FDB10CFA9D584ADEBBF4EF48324F15841AE915A7310D374A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 011C2341, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(0000000D,00000000,?,?), ref: 011C23C3

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 926e18239dd21b2da62a5a51555d67872503e7a17696f21b2c2c85e7164be2a2
Instruction ID: bf4447d56a43d5bd7689b4a8966c24d18bddb09ea669b4520d334a1f19d7d5fe
Opcode Fuzzy Hash: 926e18239dd21b2da62a5a51555d67872503e7a17696f21b2c2c85e7164be2a2
Instruction Fuzzy Hash: 242138B1D042088FCB14CF99D844BEEBBF5FB88314F10841AE415B3650C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011CBD48, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?), ref: 011CD92A

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0fadee9e3019b9bf869d32a6643d356d27cafd6f6b95ac708a007742b9d226e3
Instruction ID: 40c8c55c3b1266209fd0356a2642483d3e0f260b96fa7991943d925eae473fcc
Opcode Fuzzy Hash: 0fadee9e3019b9bf869d32a6643d356d27cafd6f6b95ac708a007742b9d226e3
Instruction Fuzzy Hash: F91133B69002088FCB14DFAAD444BDEFBF4AB88324F00842EE519A7300C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0149C1B8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0149C232

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 933c71a18ad996800b4bbe60cdbb8adaf54ca5cf1cb6f252758d1d8a53bc8719
Instruction ID: 3abe9ffe5fc60102ce2c9f9f90efb5e4f6d8ae7e3d37a9f4028a93fbe12f8bed
Opcode Fuzzy Hash: 933c71a18ad996800b4bbe60cdbb8adaf54ca5cf1cb6f252758d1d8a53bc8719
Instruction Fuzzy Hash: 7E1159B19003458FDB10EFAAD54879EBFF4FB49324F60846AE449A7710CB396944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011C0960, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 011C09CF

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 90179eaef832f8be3066f13989ad8f64c6f2e89827b2025b1dbeb14da296763b
Instruction ID: e461433355f73a4fa2b43d71541d60253515e59024c1fe9d4e97956d7e4f068c
Opcode Fuzzy Hash: 90179eaef832f8be3066f13989ad8f64c6f2e89827b2025b1dbeb14da296763b
Instruction Fuzzy Hash: B21103B1C006199FCB10DFAAC444BEEFBB4BF48324F15812AE818B7240D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011C0968, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 011C09CF

Memory Dump Source

Source File: 00000007.00000002.469559006.00000000011C0000.00000040.00000001.sdmp, Offset: 011C0000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f53b28c8f542af86503c05d1c420642165bfa5a0390c3de2db5d8fde6bfb3e33
Instruction ID: a49612869d3f5f17c91e222bcce4f1cedff78a495be0c477b4d495166b3f2790
Opcode Fuzzy Hash: f53b28c8f542af86503c05d1c420642165bfa5a0390c3de2db5d8fde6bfb3e33
Instruction Fuzzy Hash: 80111FB1C006199BCB10DFAAC444BDEFBB4AB48324F15812AE828B7240D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01493300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01494116

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9344cc519225d2940481eba4bc7f6ad9705d92a7397946958769c4f9072c674e
Instruction ID: 28ea85574eca14db860e4ad7eba7f36ac9b6b95b81c9732924240c921908426f
Opcode Fuzzy Hash: 9344cc519225d2940481eba4bc7f6ad9705d92a7397946958769c4f9072c674e
Instruction Fuzzy Hash: AE1132B1D006498FDB20DF9AC548BDEFBF4EB88224F14842AD829B7710C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014940AA, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01494116

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 131f77f565dda371cbce660cce9da51e0657dbd7a9785710b1aa5fbbbae1145e
Instruction ID: 8be1dd3e488c5a5d1c8a66ffd3e9c76ebddc7050f84393d841fc986235a235b4
Opcode Fuzzy Hash: 131f77f565dda371cbce660cce9da51e0657dbd7a9785710b1aa5fbbbae1145e
Instruction Fuzzy Hash: CA1132B2C002498FCB10CF9AC949BDEFBF4EB88224F14841AD829B3710C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01494080, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01494116

Memory Dump Source

Source File: 00000007.00000002.471892925.0000000001490000.00000040.00000001.sdmp, Offset: 01490000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a31b557adf8dbd75f6da85a2a73c34f68ceb0d64d1f275f16ff46f366e9a862a
Instruction ID: e7b795402d7433118e8c398f35c6d027f36f343622a05d8324c646918c199de1
Opcode Fuzzy Hash: a31b557adf8dbd75f6da85a2a73c34f68ceb0d64d1f275f16ff46f366e9a862a
Instruction Fuzzy Hash: 6D118BF69006448FDB10CF9AD40538AFBF0EF99318F28859AC158A7262D3369447CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0143D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.471633195.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18294d7b66c1110d33e87736438d0a5aaaafbab28fffe6fb8bf6ea00f0a4b9e3
Instruction ID: 6c4a6572169617dbe764c7d7cd71e2f756e7e3608ae5451f595be62b2965218a
Opcode Fuzzy Hash: 18294d7b66c1110d33e87736438d0a5aaaafbab28fffe6fb8bf6ea00f0a4b9e3
Instruction Fuzzy Hash: 3F2133B0904200DFCB10DF64D9C0B26FB75FB88758F60C5AAE80A4B366C336D807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0143D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.471633195.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd470cf76207cb41f6d0ce587eac2cb9c6f1822eb16295cdfe03daf7d475d554
Instruction ID: 1df94a3e6ba2d87c199f8e5ae45231818955236db173eec743d4589803c0a0a8
Opcode Fuzzy Hash: fd470cf76207cb41f6d0ce587eac2cb9c6f1822eb16295cdfe03daf7d475d554
Instruction Fuzzy Hash: C72180755093808FCB12CF24D590716FF71EB86214F28C5DBD8498B667C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Scan copy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre