Play interactive tour

Edit tour

Windows Analysis Report kwFDCU89PZ.exe

Overview

General Information

Sample Name:	kwFDCU89PZ.exe
Analysis ID:	452666
MD5:	6733d5e8934eaff7c0087e7de2c8e62a
SHA1:	6c0b89dc4c773e51d660780450cbd148f2ff3211
SHA256:	3441d4122b712a32e1c0518f02903a632ecbf557fbab71c510c732474d326cd1
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large strings

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

kwFDCU89PZ.exe (PID: 7132 cmdline: 'C:\Users\user\Desktop\kwFDCU89PZ.exe' MD5: 6733D5E8934EAFF7C0087E7DE2C8E62A)

schtasks.exe (PID: 7164 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

kwFDCU89PZ.exe (PID: 1296 cmdline: {path} MD5: 6733D5E8934EAFF7C0087E7DE2C8E62A)

kwFDCU89PZ.exe (PID: 7072 cmdline: {path} MD5: 6733D5E8934EAFF7C0087E7DE2C8E62A)

MLdAu.exe (PID: 1868 cmdline: 'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe' MD5: 6733D5E8934EAFF7C0087E7DE2C8E62A)

MLdAu.exe (PID: 6280 cmdline: 'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe' MD5: 6733D5E8934EAFF7C0087E7DE2C8E62A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: kwFDCU89PZ.exe PID: 7072	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: kwFDCU89PZ.exe PID: 7072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kwFDCU89PZ.exe PID: 7132	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: kwFDCU89PZ.exe PID: 7132	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.kwFDCU89PZ.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.kwFDCU89PZ.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.447e770.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.447e770.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Virustotal: Detection: 15%			Perma Link
Source: C:\Users\user\AppData\Roaming\WzyRXCWtdGSdEA.exe	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: kwFDCU89PZ.exe

Virustotal: Detection: 15%

Perma Link

Source: 12.2.kwFDCU89PZ.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: kwFDCU89PZ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: kwFDCU89PZ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: http://BGwprh.com
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://login.blockchain.com/
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://login.blockchain.com/ObjectLengthChainingModeGCMAuthTagLengthChainingModeKeyDataBlobAESMicro
Source: kwFDCU89PZ.exe, 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, kwFDCU89PZ.exe, 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary:

.NET source code contains very large strings

Show sources

Source: kwFDCU89PZ.exe, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: WzyRXCWtdGSdEA.exe.1.dr, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 1.2.kwFDCU89PZ.exe.fe0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 1.0.kwFDCU89PZ.exe.fe0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 11.0.kwFDCU89PZ.exe.3c0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: 11.2.kwFDCU89PZ.exe.3c0000.0.unpack, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771
Source: MLdAu.exe.12.dr, Utilities/UI.Controls/Design/YaTabControlDesigner.cs	Long String: Length: 32771

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 1_2_0316C134	1_2_0316C134
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 1_2_0316E578	1_2_0316E578
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 1_2_0316E56A	1_2_0316E56A
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_030B48E0	12_2_030B48E0
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_030B48D0	12_2_030B48D0
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_030BDD41	12_2_030BDD41
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_061D6DA0	12_2_061D6DA0
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_061D9978	12_2_061D9978
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_061D79B8	12_2_061D79B8
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_0117C134	17_2_0117C134
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_0117E578	17_2_0117E578
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_0117E569	17_2_0117E569
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_08CC0FC0	17_2_08CC0FC0
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_08CC0C28	17_2_08CC0C28
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_02DEC134	19_2_02DEC134
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_02DEE578	19_2_02DEE578
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_02DEE56A	19_2_02DEE56A
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_075E7908	19_2_075E7908
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_09100FC0	19_2_09100FC0
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_09100FBA	19_2_09100FBA

Source: kwFDCU89PZ.exe	Binary or memory string: OriginalFilename vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 00000001.00000002.752969338.00000000045B1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 00000001.00000002.763508346.00000000077F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 00000001.00000002.747289941.0000000000FE2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFTkxD.exe4 vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 00000001.00000002.763729715.0000000007910000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameujwgwcyhtpqCnYQxVzecNLZpOeEfHt.exe4 vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe	Binary or memory string: OriginalFilename vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 0000000B.00000002.745396129.00000000003C2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFTkxD.exe4 vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe	Binary or memory string: OriginalFilename vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 0000000C.00000002.918926272.0000000000C32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFTkxD.exe4 vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameujwgwcyhtpqCnYQxVzecNLZpOeEfHt.exe4 vs kwFDCU89PZ.exe
Source: kwFDCU89PZ.exe, 0000000C.00000002.922388812.00000000012DA000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kwFDCU89PZ.exe

Source: kwFDCU89PZ.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: kwFDCU89PZ.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WzyRXCWtdGSdEA.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MLdAu.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/5@0/0

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File created: C:\Users\user\AppData\Roaming\WzyRXCWtdGSdEA.exe

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Mutant created: \Sessions\1\BaseNamedObjects\bCmLOidXVAcpgGmAXeH
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_01

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC023.tmp

Jump to behavior

Source: kwFDCU89PZ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kwFDCU89PZ.exe

Virustotal: Detection: 15%

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File read: C:\Users\user\Desktop\kwFDCU89PZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe 'C:\Users\user\Desktop\kwFDCU89PZ.exe'
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe 'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe 'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe'
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: kwFDCU89PZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kwFDCU89PZ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: kwFDCU89PZ.exe, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: WzyRXCWtdGSdEA.exe.1.dr, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.2.kwFDCU89PZ.exe.fe0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 1.0.kwFDCU89PZ.exe.fe0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.kwFDCU89PZ.exe.3c0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.2.kwFDCU89PZ.exe.3c0000.0.unpack, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: MLdAu.exe.12.dr, Utilities/YatcForm.cs	.Net Code: EFEFEFEFEFEF System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 1_2_00FE7F11 push es; iretd	1_2_00FE815A
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 11_2_003C7F11 push es; iretd	11_2_003C815A
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Code function: 12_2_00C37F11 push es; iretd	12_2_00C3815A
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 17_2_00767F11 push es; iretd	17_2_0076815A
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_00CA7F11 push es; iretd	19_2_00CA815A
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_02DEB5D1 pushad ; retf	19_2_02DEB5ED
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_02DEF932 push esp; iretd	19_2_02DEF939
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Code function: 19_2_075EFC00 push eax; iretd	19_2_075EFC01

Source: initial sample	Static PE information: section name: .text entropy: 7.51973544971
Source: initial sample	Static PE information: section name: .text entropy: 7.51973544971
Source: initial sample	Static PE information: section name: .text entropy: 7.51973544971

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	File created: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe			Jump to dropped file
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	File created: C:\Users\user\AppData\Roaming\WzyRXCWtdGSdEA.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp'

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MLdAu			Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MLdAu			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

File opened: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: kwFDCU89PZ.exe PID: 7132, type: MEMORY

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Window / User API: threadDelayed 9707

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe TID: 5068	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe TID: 5308	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Memory written: C:\Users\user\Desktop\kwFDCU89PZ.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Process created: C:\Users\user\Desktop\kwFDCU89PZ.exe {path}	Jump to behavior

Source: kwFDCU89PZ.exe, 0000000C.00000002.923926317.00000000019A0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.923754592.00000000015A0000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.922834447.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: kwFDCU89PZ.exe, 0000000C.00000002.923926317.00000000019A0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.923754592.00000000015A0000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.922834447.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: kwFDCU89PZ.exe, 0000000C.00000002.923926317.00000000019A0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.923754592.00000000015A0000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.922834447.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: kwFDCU89PZ.exe, 0000000C.00000002.923926317.00000000019A0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.923754592.00000000015A0000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.922834447.0000000001970000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Users\user\Desktop\kwFDCU89PZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Users\user\Desktop\kwFDCU89PZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kwFDCU89PZ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Code function: 12_2_061D53AC GetUserNameW,

12_2_061D53AC

Source: C:\Users\user\Desktop\kwFDCU89PZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 12.2.kwFDCU89PZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 12.2.kwFDCU89PZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwFDCU89PZ.exe PID: 7072, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwFDCU89PZ.exe PID: 7132, type: MEMORY

Source: Yara match	File source: 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwFDCU89PZ.exe PID: 7072, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 12.2.kwFDCU89PZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 12.2.kwFDCU89PZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.44b4d90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kwFDCU89PZ.exe.447e770.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwFDCU89PZ.exe PID: 7072, type: MEMORY
Source: Yara match	File source: Process Memory Space: kwFDCU89PZ.exe PID: 7132, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Registry Run Keys / Startup Folder1	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery311	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Virtualization/Sandbox Evasion131	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion131	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Account Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery113	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kwFDCU89PZ.exe	15%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe	15%	Virustotal		Browse
C:\Users\user\AppData\Roaming\WzyRXCWtdGSdEA.exe	15%	Virustotal		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
12.2.kwFDCU89PZ.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://BGwprh.com	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://DynDns.comDynDNS	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.tiro.com	MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.blockchain.com/ObjectLengthChainingModeGCMAuthTagLengthChainingModeKeyDataBlobAESMicro	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers	MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.blockchain.com/	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers8	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://BGwprh.com	kwFDCU89PZ.exe, 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kwFDCU89PZ.exe, 00000001.00000002.749239320.0000000003381000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	kwFDCU89PZ.exe, 00000001.00000002.755235202.00000000062D0000.00000002.00000001.sdmp, MLdAu.exe, 00000011.00000002.930900909.0000000005B50000.00000002.00000001.sdmp, MLdAu.exe, 00000013.00000002.930785510.0000000005FC0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	kwFDCU89PZ.exe, 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, kwFDCU89PZ.exe, 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452666
Start date:	22.07.2021
Start time:	17:41:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	kwFDCU89PZ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/5@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 0% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:43:14	API Interceptor	360x Sleep call for process: kwFDCU89PZ.exe modified
17:43:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MLdAu C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe
17:43:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MLdAu C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kwFDCU89PZ.exe.log Download File
Process:	C:\Users\user\Desktop\kwFDCU89PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.34763300334957
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzp
MD5:	17AB73C45E39AAD8F7C9A94F41D29977
SHA1:	17DE8F6B64A2E722B9695D219E22D169C32F3B3F
SHA-256:	8AAD593D9F1E9AEE7F3161EDC9E124C9AAD7721128E0F84FD7E8B27DE1A3685B
SHA-512:	F02D9DAE41AB2FDDC629BCD93062DC4EAAF359DDAAC15165F5283CEFF86295C6A65AFF77617CDEC948116FCD2BFB0C223E6BA4634BF9BB45054A5FA418F02C90
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\tmpC023.tmp Download File
Process:	C:\Users\user\Desktop\kwFDCU89PZ.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1647
Entropy (8bit):	5.1896865486664385
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGUtn:cbhK79lNQR/rydbz9I3YODOLNdq3l
MD5:	5132A0FE53B84774AEA732D8487C71B0
SHA1:	40B5FD932D42D951928CDC39E34695803D9C6348
SHA-256:	56407DF982AE0485AB4C9949E13F96651FC46257C1B5AAE87D0533FE6029893D
SHA-512:	DE94DEFCA3B741F9F4DDF590A3B67D44C6901AA96C78C0C98328778704D5F007F996A0870F7B59D47E1BD190240A94778EEB42AEA7021D0F38E6167E2FC4CAC5
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe Download File
Process:	C:\Users\user\Desktop\kwFDCU89PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	7.4170903584629215
Encrypted:	false
SSDEEP:	12288:NUdeni+TLedHTiw3CzfM5B2OR0GU4V24TfWOQCs/I:KciCqdziw3KeRHtJHs/I
MD5:	6733D5E8934EAFF7C0087E7DE2C8E62A
SHA1:	6C0B89DC4C773E51D660780450CBD148F2FF3211
SHA-256:	3441D4122B712A32E1C0518F02903A632ECBF557FBAB71C510C732474D326CD1
SHA-512:	B6804A6968FA7A6F68D1A8F6161A0C69584DBFEB88EFF5F7784C259F2886FE1B444438576D47AB5DDA24496A619DFBFFE02050BC679A3F3E13DD6BC82F61C3C1
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 15%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.`..............0.. ... .......5... ...@....... ....................................@.................................05..O....@.......................`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@.......0..............@..@.reloc.......`.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\kwFDCU89PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\WzyRXCWtdGSdEA.exe Download File
Process:	C:\Users\user\Desktop\kwFDCU89PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	479232
Entropy (8bit):	7.4170903584629215
Encrypted:	false
SSDEEP:	12288:NUdeni+TLedHTiw3CzfM5B2OR0GU4V24TfWOQCs/I:KciCqdziw3KeRHtJHs/I
MD5:	6733D5E8934EAFF7C0087E7DE2C8E62A
SHA1:	6C0B89DC4C773E51D660780450CBD148F2FF3211
SHA-256:	3441D4122B712A32E1C0518F02903A632ECBF557FBAB71C510C732474D326CD1
SHA-512:	B6804A6968FA7A6F68D1A8F6161A0C69584DBFEB88EFF5F7784C259F2886FE1B444438576D47AB5DDA24496A619DFBFFE02050BC679A3F3E13DD6BC82F61C3C1
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 15%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.`..............0.. ... .......5... ...@....... ....................................@.................................05..O....@.......................`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@.......0..............@..@.reloc.......`.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.4170903584629215
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kwFDCU89PZ.exe
File size:	479232
MD5:	6733d5e8934eaff7c0087e7de2c8e62a
SHA1:	6c0b89dc4c773e51d660780450cbd148f2ff3211
SHA256:	3441d4122b712a32e1c0518f02903a632ecbf557fbab71c510c732474d326cd1
SHA512:	b6804a6968fa7a6f68d1a8f6161a0c69584dbfeb88eff5f7784c259f2886fe1b444438576d47ab5dda24496a619dfbffe02050bc679a3f3e13dd6bc82f61c3c1
SSDEEP:	12288:NUdeni+TLedHTiw3CzfM5B2OR0GU4V24TfWOQCs/I:KciCqdziw3KeRHtJHs/I
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u.`..............0.. ... .......5... ...@....... ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x11073582
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x11000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F97501 [Thu Jul 22 13:39:13 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [11002000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73530	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x74000	0x618	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x71588	0x72000	False	0.809373286732	data	7.51973544971	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x74000	0x618	0x1000	False	0.173583984375	data	2.02244348896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x76000	0xc	0x1000	False	0.0087890625	data	0.0164084645156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x74090	0x388	data
RT_MANIFEST	0x74428	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2005-2013 by Gray Iris Software LC
Assembly Version	1.0.3.3
InternalName	FTkxD.exe
FileVersion	1.0.3.3
CompanyName	Gray Iris Software LC
Comments	A library of commonly-needed utility classes.
ProductVersion	1.0.3.3
FileDescription	Utilities from Gray Iris Software LC.
OriginalFilename	FTkxD.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: kwFDCU89PZ.exe PID: 7132 Parent PID: 5776

General

Start time:	17:42:03
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\kwFDCU89PZ.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\kwFDCU89PZ.exe'
Imagebase:	0xfe0000
File size:	479232 bytes
MD5 hash:	6733D5E8934EAFF7C0087E7DE2C8E62A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.752688266.0000000004388000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 7164 Parent PID: 7132

General

Start time:	17:42:45
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\WzyRXCWtdGSdEA' /XML 'C:\Users\user\AppData\Local\Temp\tmpC023.tmp'
Imagebase:	0xfa0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7148 Parent PID: 7164

General

Start time:	17:42:46
Start date:	22/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: kwFDCU89PZ.exe PID: 1296 Parent PID: 7132

General

Start time:	17:42:46
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\kwFDCU89PZ.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x3c0000
File size:	479232 bytes
MD5 hash:	6733D5E8934EAFF7C0087E7DE2C8E62A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: kwFDCU89PZ.exe PID: 7072 Parent PID: 7132

General

Start time:	17:42:47
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\kwFDCU89PZ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xc30000
File size:	479232 bytes
MD5 hash:	6733D5E8934EAFF7C0087E7DE2C8E62A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000C.00000002.918861849.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.924292375.00000000030D1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: MLdAu.exe PID: 1868 Parent PID: 3424

General

Start time:	17:43:33
Start date:	22/07/2021
Path:	C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe'
Imagebase:	0x760000
File size:	479232 bytes
MD5 hash:	6733D5E8934EAFF7C0087E7DE2C8E62A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 15%, Virustotal, Browse
Reputation:	low

Chronological Activities

Analysis Process: MLdAu.exe PID: 6280 Parent PID: 3424

General

Start time:	17:43:41
Start date:	22/07/2021
Path:	C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\MLdAu\MLdAu.exe'
Imagebase:	0xca0000
File size:	479232 bytes
MD5 hash:	6733D5E8934EAFF7C0087E7DE2C8E62A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: kwFDCU89PZ.exe PID: 7132 Parent PID: 5776 kwFDCU89PZ.exeCOMMON

Executed Functions

Function 0316B680, Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0316B6F0
GetCurrentThread.KERNEL32 ref: 0316B72D
GetCurrentProcess.KERNEL32 ref: 0316B76A
GetCurrentThreadId.KERNEL32 ref: 0316B7C3

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 71ab4bf78510e84f3c6a81cab44961367cacc0401355bd3ffd2fe0a46613be77
Instruction ID: cd732f25948980e64d8011ae2b0893ead87dbeed6bcd82663e872978d011b944
Opcode Fuzzy Hash: 71ab4bf78510e84f3c6a81cab44961367cacc0401355bd3ffd2fe0a46613be77
Instruction Fuzzy Hash: 735144B49042498FDB10CFAAC688BEEBBF5AF8C314F24C559E419A7390D7746844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0316B690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0316B6F0
GetCurrentThread.KERNEL32 ref: 0316B72D
GetCurrentProcess.KERNEL32 ref: 0316B76A
GetCurrentThreadId.KERNEL32 ref: 0316B7C3

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 63c1805fa921fb2f6469bf406cc83b5228242f42d32b7d1b07aa990e4aaf294d
Instruction ID: 2da1e0f7adf40b58becf44142f5af19c5ac598f9ba24b8664ce55da921fe06f2
Opcode Fuzzy Hash: 63c1805fa921fb2f6469bf406cc83b5228242f42d32b7d1b07aa990e4aaf294d
Instruction Fuzzy Hash: 995133B49042498FDB14CFAAC688BDEBBF5AF8C314F24C459E419A7390D7746884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03169690, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 031698D6

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 70cc2288add9fc71fe86dabc188978a0d97401775bbf4d96438eb2522500297f
Instruction ID: 128282659a02570e106ab4947441b22d6decd7375718e60f9abf4120bb61ce92
Opcode Fuzzy Hash: 70cc2288add9fc71fe86dabc188978a0d97401775bbf4d96438eb2522500297f
Instruction Fuzzy Hash: B9712370A00B058FDB64DFAAD04479ABBF5FF88204F04892ED55ADBA40DB74E855CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0316FCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0316FE0A

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e8e0ad7bbc7abd84ad7972b2e8c963f7d3b999e09e7e3ee07f0955375661d014
Instruction ID: 12da6e930dfa5c8cc5a4a9f9d13ff25591b7c3dc0322d97bc11bf8ef6bdfba81
Opcode Fuzzy Hash: e8e0ad7bbc7abd84ad7972b2e8c963f7d3b999e09e7e3ee07f0955375661d014
Instruction Fuzzy Hash: F341D0B1D003099FDB14CF99D884ADEBFB5FF48310F25812AE418AB210D774A895CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03165364, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03165421

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ad3cfa379205e11109109949103bc35dabd600aab5e5029768c8a6d5a61401d
Instruction ID: 6aa7c361798c72b21ec53a3c1ca1a3219e5856e7407c096e584659247560dab4
Opcode Fuzzy Hash: 7ad3cfa379205e11109109949103bc35dabd600aab5e5029768c8a6d5a61401d
Instruction Fuzzy Hash: B54106B1C00218CFDB24CFAAC8847DDBBB6BF49305F25806AD419BB255D7756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03163CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 03165421

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: de44bf9d6dd0845a9549c225d836330d5f821710037da3933bcfd3d7907ef772
Instruction ID: d9285e9b6fe62ee9ff7ce9fcba76b39867f059f0f902fcbc5fbbc33557d17df9
Opcode Fuzzy Hash: de44bf9d6dd0845a9549c225d836330d5f821710037da3933bcfd3d7907ef772
Instruction Fuzzy Hash: 3741E271C0421CCFDB24DFAAC884BDEBBB6BF49304F148069D419AB255DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0316B8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0316B93F

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2de461e07df29a85c38f7b26e76a4094f5be5d9ed1a0de2557a29a3b543539c8
Instruction ID: aaed0c52a49348fb0474b68d442b880b551f9f6731b77127d843a7fb294f15c5
Opcode Fuzzy Hash: 2de461e07df29a85c38f7b26e76a4094f5be5d9ed1a0de2557a29a3b543539c8
Instruction Fuzzy Hash: CC21E2B59002199FDB10CFAAD984BDEBFF8EB48320F14841AE914A3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031692A8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,03169951,00000800,00000000,00000000), ref: 03169B62

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 85f6aa994ad44a78b2129c465eecbdf1747f77a4ada09f61cdd771e97b690c00
Instruction ID: 5ad0e515666ffe59f7e552c7f5fc8a36bfc8ce1f28c9ade5334ea45b991f3a7b
Opcode Fuzzy Hash: 85f6aa994ad44a78b2129c465eecbdf1747f77a4ada09f61cdd771e97b690c00
Instruction Fuzzy Hash: 251114B6D042498FDB10CF9AC484BDEFBF4EB48320F15852ED415A7200C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03169870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 031698D6

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 93155eff69916f9ea2f7c430b516ff751028c09d29fdf53fd6082b057f6fe675
Instruction ID: 7654a4b9e919189b125541942d0eb53c17178e705bb20dc50456a9a00f814cf3
Opcode Fuzzy Hash: 93155eff69916f9ea2f7c430b516ff751028c09d29fdf53fd6082b057f6fe675
Instruction Fuzzy Hash: DE11EDB6C002498FDB10CF9AD444BDEFBF8EB88324F14842AD829B7600D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0316FF40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0316FF9D

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 17d8be3c405ede15a4d8a754cf1ced4509b04335e442f70cd87e502e55eb89f9
Instruction ID: f44d7fc087ff0b4673d3efe87ee0bcb01c95a93b7ebbaf2c5ced38b49eb0f46c
Opcode Fuzzy Hash: 17d8be3c405ede15a4d8a754cf1ced4509b04335e442f70cd87e502e55eb89f9
Instruction Fuzzy Hash: 4411E2B58002499FDB10CF9AD585BDFFBF8EB48324F14845AE955A7340C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0170D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e00b14d6c8ec422d8efaa1a71be8e0b6203b8b9494d57baec25b72c58df8234
Instruction ID: 055fe34b6c0e97e0d96588ca2cd42b8e1bae2ba5860caa7fc0a76af5f755dceb
Opcode Fuzzy Hash: 0e00b14d6c8ec422d8efaa1a71be8e0b6203b8b9494d57baec25b72c58df8234
Instruction Fuzzy Hash: 6821D6B1504344DFDB26DF94D9C0B26FFA5FB88318F3485A9ED054B286C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748445897.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dee8e43f4c5b67cfce440ed27c0c18e2d3a912a2ec98585847cd7d9f6bbed57
Instruction ID: 0cedde84ef824b919066b9e489d9eca35f0785cb797fdfedfc1d6929b6d24b38
Opcode Fuzzy Hash: 4dee8e43f4c5b67cfce440ed27c0c18e2d3a912a2ec98585847cd7d9f6bbed57
Instruction Fuzzy Hash: 1A2149B1508200DFDB11CF98C5C8B66FBA5FB84324F24C6ADD9094B24AC33AD806CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0171D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748445897.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288acf5ff5012d2c9fbfb66f55ba1b8b862522dfbb8b771cd069342e81278bab
Instruction ID: f737d910e8b988a7fa1ba4ec12c97cccd43e3c3a29ccbe4b7b34c0683676640f
Opcode Fuzzy Hash: 288acf5ff5012d2c9fbfb66f55ba1b8b862522dfbb8b771cd069342e81278bab
Instruction Fuzzy Hash: C22137B5604204DFDB25CF68D8C8B16FB65FB84354F24C5ADD9094B24AC33AD847CE61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction ID: 950a4f4006c536a498ed174062d225441a5c10698af7d9e3e438f861bbb2aa00
Opcode Fuzzy Hash: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction Fuzzy Hash: 51119D76404380CFCB12CF54D5C4B16FFB1FB88224F2886A9D8450B656C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748445897.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction ID: d35ceb40be172c0c5765952ac7fa316f296646b533083d21b4569eaa7165bae1
Opcode Fuzzy Hash: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction Fuzzy Hash: FC118E75504280DFDB12CF58D5D8B15FB61FB44314F28C6AAD8494B65AC33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0171D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748445897.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction ID: cd5851a2e3825de1d2daf1093a643c3995610334d73c92441828140ad886b2e4
Opcode Fuzzy Hash: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction Fuzzy Hash: 93118B75908280DFDB12CF58D5C8B55FBB1FB84224F28C6AAD8494B65AC33AD44ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 0170D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7271c05459daccd9cb312544baad65e66243af52194dae72b4cbf609fcef39f5
Instruction ID: aa48868e3e04a9cc29a38ed53a1395f00f9fc0c34a93ab6f98fed5d2936374f4
Opcode Fuzzy Hash: 7271c05459daccd9cb312544baad65e66243af52194dae72b4cbf609fcef39f5
Instruction Fuzzy Hash: 3301A771408390DAE7324AAACC84B66FBD8EF81378F08D55AEE045B2C6D7799444CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0170D6CF, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c51b44f9933cb07df77c4f6e8c513957f0bc01a586c82e2f3abbc2a3f06d06
Instruction ID: ffc4c866794594ab61afaa35be0baf5f9962bf3588a3432f13cffebd6bb1d688
Opcode Fuzzy Hash: 01c51b44f9933cb07df77c4f6e8c513957f0bc01a586c82e2f3abbc2a3f06d06
Instruction Fuzzy Hash: D3F0F976200600AF93208F4AD884C2BFBEDFBC4770715C59AE8494B752C671EC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0170D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14ff30e703643cfd022c148cb91fd5618911becf2e16615404a64b0bbb183f0
Instruction ID: 92cfa393224cb848342b482bb87832888aabe083af94764a34ade074c2470d75
Opcode Fuzzy Hash: e14ff30e703643cfd022c148cb91fd5618911becf2e16615404a64b0bbb183f0
Instruction Fuzzy Hash: 81F09671404394DEE7218E5ACCC4B67FFE8EB81774F18C45AED085B286C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0170D6C0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748407637.000000000170D000.00000040.00000001.sdmp, Offset: 0170D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ec51a6fe6947f8db9c50a0384e7ea641b0a19a70ca66b64a6e78b7744318e
Instruction ID: 7ca76100f15013b088656d6139ced79458852353439bbbbb6256c2df76c4115a
Opcode Fuzzy Hash: 5b6ec51a6fe6947f8db9c50a0384e7ea641b0a19a70ca66b64a6e78b7744318e
Instruction Fuzzy Hash: A6F03C75104780AFD3258F46C884C27BFF9EB867607198489E8994B352C630FC42CFA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0316E578, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21289762eb001a4ddd45e4aa7ec8c26dd00d8eaf184f334c3eae70bdc4db9d05
Instruction ID: 3307384297e9a8453eded09ab09a30725fe73e14bfd736fa0e877f83e6b3b3f2
Opcode Fuzzy Hash: 21289762eb001a4ddd45e4aa7ec8c26dd00d8eaf184f334c3eae70bdc4db9d05
Instruction Fuzzy Hash: 1112C8F54117468BD318EF65E8D81C93BA3F74A328F906208D2612BAD9D7B815C6CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 0316C134, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38cee75308a536aad09f869afb7b4089b45d8fd15786d1428a41dcf152eddcd
Instruction ID: 8fc8de09912aed6b496b83a3e6cae9b16d4a374e090e884285dbb948a6525b15
Opcode Fuzzy Hash: f38cee75308a536aad09f869afb7b4089b45d8fd15786d1428a41dcf152eddcd
Instruction Fuzzy Hash: 64A15D36E0021ACFCF05DFE5D8445DEBBB6FF89300B15856AE905AB261EB31A955CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0316E56A, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.748918340.0000000003160000.00000040.00000001.sdmp, Offset: 03160000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d89eada3cfc96e83e7142c1a303d588f062b4e6fba6f7922808bd00f4de3e3a
Instruction ID: 6c455c1bf65f2237d394c008000eb60567aac0e7f69ba0c1ee1ab925e9b553c2
Opcode Fuzzy Hash: 4d89eada3cfc96e83e7142c1a303d588f062b4e6fba6f7922808bd00f4de3e3a
Instruction Fuzzy Hash: 0BC12AB18117468BD718EF64E8D81C97BB3FB8A328F515308D1612B6D9D7B814C6CFA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kwFDCU89PZ.exe PID: 7072 Parent PID: 7132 kwFDCU89PZ.exeCOMMON

Executed Functions

Function 061D53AC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 061DBAB3

Strings

{LfZ, xrefs: 061DB9BD
{LfZ, xrefs: 061DB99D

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: NameUser
String ID: {LfZ${LfZ
API String ID: 2645101109-3864552060
Opcode ID: 962d0f4d200d9684b92b03c930cf7f57e814dc7ad99cf342bf24885b8ad206f0
Instruction ID: 1fe868f9a7e4496902afa09dd5319fa6624ba9a186fd34b3e06cd3d5d5e8c806
Opcode Fuzzy Hash: 962d0f4d200d9684b92b03c930cf7f57e814dc7ad99cf342bf24885b8ad206f0
Instruction Fuzzy Hash: 385125B1E042188FDB58CFA9C89579DBBF1BF48314F168119E816BB3A0DB74A840CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030B6B58, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 030B6BE0
GetCurrentThread.KERNEL32 ref: 030B6C1D
GetCurrentProcess.KERNEL32 ref: 030B6C5A
GetCurrentThreadId.KERNEL32 ref: 030B6CB3

Strings

{LfZ, xrefs: 030B6B9C

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: {LfZ
API String ID: 2063062207-1558444270
Opcode ID: a389b3d87cff76c417ad50be23cfda0eb29332e107dcab8fca8763d902c02a4a
Instruction ID: 1dd62deeb1b0666cf419c37147f63e3a52f16f47be2438e2fcdeb0700dee5511
Opcode Fuzzy Hash: a389b3d87cff76c417ad50be23cfda0eb29332e107dcab8fca8763d902c02a4a
Instruction Fuzzy Hash: 6D5168B09053888FDB04CFA9C549BEEBFF0EF49304F1884AAE449A7351DB356844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 030B6B80, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 030B6BE0
GetCurrentThread.KERNEL32 ref: 030B6C1D
GetCurrentProcess.KERNEL32 ref: 030B6C5A
GetCurrentThreadId.KERNEL32 ref: 030B6CB3

Strings

{LfZ, xrefs: 030B6B9C

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: {LfZ
API String ID: 2063062207-1558444270
Opcode ID: d2862a48a8ee4098fb7d7cf6d94fb66f9d4a890e3af43080b999b00c9125105b
Instruction ID: 9478823c6e30a1338cfb0ab633377f38cbe54d9491e262007fa3cbba87a5e91a
Opcode Fuzzy Hash: d2862a48a8ee4098fb7d7cf6d94fb66f9d4a890e3af43080b999b00c9125105b
Instruction Fuzzy Hash: 545144B09012498FDB14CFAAC649BEEBFF0EF89314F24846AE419A7350DB356844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 061D974C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 061DBAB3

Strings

{LfZ, xrefs: 061DB9BD
{LfZ, xrefs: 061DB99D

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: NameUser
String ID: {LfZ${LfZ
API String ID: 2645101109-3864552060
Opcode ID: 5e964cda18deaebcf49b549bcb210362efc21b1d676dfc5905ded90a487b8fed
Instruction ID: fcb1b066f7b60c867ba199e461fd21740b1b9ef4dd2e8363156cf502eb5c88bf
Opcode Fuzzy Hash: 5e964cda18deaebcf49b549bcb210362efc21b1d676dfc5905ded90a487b8fed
Instruction Fuzzy Hash: D65114B1E042188FDB58CFA9C89579DBBF1BF48314F168119E816BB3A0D774A844CF94

Uniqueness

Uniqueness Score: -1.00%

Function 030B52C4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030B53E2

Strings

{LfZ, xrefs: 030B531E
{LfZ, xrefs: 030B52FE

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: {LfZ${LfZ
API String ID: 716092398-3864552060
Opcode ID: 1dfca37c27fd8edabbcb1b7dae34efffbc4b54958e2ceb1350dcf7c1d61824e4
Instruction ID: 02104e60388792e772ba9c2f592b88f7d5dc38fccdc0f355c3ad1658d9255932
Opcode Fuzzy Hash: 1dfca37c27fd8edabbcb1b7dae34efffbc4b54958e2ceb1350dcf7c1d61824e4
Instruction Fuzzy Hash: 6451CEB1D003499FDB14CFAAC884ADEFBF5BF48314F24816AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030B52D0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 030B53E2

Strings

{LfZ, xrefs: 030B531E
{LfZ, xrefs: 030B52FE

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: {LfZ${LfZ
API String ID: 716092398-3864552060
Opcode ID: a984a3341eace26000d2b0c8b911f82fb5ac2edf708faa9b8fcc49c22027b760
Instruction ID: a8b383a81cc53e8c4a9a9c4de026998a38a81255808256c2d0a8750e651ae65f
Opcode Fuzzy Hash: a984a3341eace26000d2b0c8b911f82fb5ac2edf708faa9b8fcc49c22027b760
Instruction Fuzzy Hash: B741CEB1D113499FDB14CFAAC884ADEFBF5BF48314F24812AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 061DE1A8, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 061DE336

Strings

{LfZ, xrefs: 061DE1D2

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: ActiveWindow
String ID: {LfZ
API String ID: 2558294473-1558444270
Opcode ID: 12e19a648600439f9e749f3cab1209b0afb486953ebd570937f489769a92bfbe
Instruction ID: e8f807ae1bb79d13def2e491eac6bab4588126346846ee9cc4b668685995c98b
Opcode Fuzzy Hash: 12e19a648600439f9e749f3cab1209b0afb486953ebd570937f489769a92bfbe
Instruction Fuzzy Hash: D6D1F270F042199FCB48ABB4D4546AE7BA7EFC9308F148029E506EB395DF749C41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 030B6ABC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 030B7D39

Strings

{LfZ, xrefs: 030B7C8F

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID: {LfZ
API String ID: 2714655100-1558444270
Opcode ID: d3ac70af76bb96d9a57f7603d5c66b7e93a0d6cac95dd8c72d99e267b92b3dbe
Instruction ID: d08d4c56e2d072a56e47ec4d79bf85e4120c95bc5f5c4d359fe0d26965c99df8
Opcode Fuzzy Hash: d3ac70af76bb96d9a57f7603d5c66b7e93a0d6cac95dd8c72d99e267b92b3dbe
Instruction Fuzzy Hash: 0F413AB4A003098FDB14CF99C488BEABBF5FF88754F148599E519AB320D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030BC8C9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 030BC952

Strings

{LfZ, xrefs: 030BC8EF

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: EncodePointer
String ID: {LfZ
API String ID: 2118026453-1558444270
Opcode ID: 13a6e907433d319cc41613f1c7b4aef41577249cd7cff509780001e2636749e0
Instruction ID: ed5ef7f7304e9cc5557dda883107aeb1518e62d5ef15ab654f0f3059856b7d00
Opcode Fuzzy Hash: 13a6e907433d319cc41613f1c7b4aef41577249cd7cff509780001e2636749e0
Instruction Fuzzy Hash: 4A31F4718053858FEB10DFA8D94A3DEBFF4EB55318F18845AD444A7341CB789449CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030B6DA2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 030B6E2F

Strings

{LfZ, xrefs: 030B6DC7

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: {LfZ
API String ID: 3793708945-1558444270
Opcode ID: d3961bc4516b2293fa1baa61be75e2f3ffc2ac5d96474d869088abf5c9d45eb0
Instruction ID: cc82572e533c91d5e11c57d25885ba1d2071d58900c60460d4e2066d1e4be10e
Opcode Fuzzy Hash: d3961bc4516b2293fa1baa61be75e2f3ffc2ac5d96474d869088abf5c9d45eb0
Instruction Fuzzy Hash: 0B21E3B59012099FDB10CFAAD984BDEBFF8EB48324F14841AE915A3310D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061DFB10, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 061DFB92

Strings

{LfZ, xrefs: 061DFB27

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: CurrentThread
String ID: {LfZ
API String ID: 2882836952-1558444270
Opcode ID: f97a1eadc03b9ea7326f9c54297f866f76ff856d587257d340058dc5a7014b73
Instruction ID: 82cd013aa5248beb3500fe2cf4bf77cee18dba3bc06c9a0c350952be8463126f
Opcode Fuzzy Hash: f97a1eadc03b9ea7326f9c54297f866f76ff856d587257d340058dc5a7014b73
Instruction Fuzzy Hash: D82122B49002498FCB40DFA9C484BDEBBF1FB49314F14896AD45AAB311D738A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030B6DA8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 030B6E2F

Strings

{LfZ, xrefs: 030B6DC7

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: {LfZ
API String ID: 3793708945-1558444270
Opcode ID: b39f1ac85fc8af538e7d76865d956a9fd71fc75a0afdce6ffc585c2c2f6759cc
Instruction ID: 7a6cd2506d7a185d291f4b791018d12b018194a85de3d34a6205a5149997da94
Opcode Fuzzy Hash: b39f1ac85fc8af538e7d76865d956a9fd71fc75a0afdce6ffc585c2c2f6759cc
Instruction Fuzzy Hash: E921E2B5D012089FDB10CFAAD984BDEFBF8EB48324F14841AE915A3310D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 061DF720, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,05CC9EE3,?,?,?,00000E28,?,?,061DFBE0,040D608C,030D82E0), ref: 061DFC71

Strings

{LfZ, xrefs: 061DFC1A

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: EnumThreadWindows
String ID: {LfZ
API String ID: 2941952884-1558444270
Opcode ID: 441a702a13570b5b8192dbb74d1b0084c1946c3fdddf11b317f05e3b7a7d9f51
Instruction ID: 9df68b39394e2ba257fb7a7700165ecd715bff2b3cac06781ecd4f1aca383ceb
Opcode Fuzzy Hash: 441a702a13570b5b8192dbb74d1b0084c1946c3fdddf11b317f05e3b7a7d9f51
Instruction Fuzzy Hash: 462127B1D002198FDB54CFAAC944BEEFBF4EB88324F14842AD855A3250D778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 061D9758, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 061DBE98

Strings

{LfZ, xrefs: 061DBE47

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: DeleteFile
String ID: {LfZ
API String ID: 4033686569-1558444270
Opcode ID: 2aa776b202c6703ff31966c23dacd79a036964c0d6e59ac51e2dfd83685ece15
Instruction ID: ca5284ff915ab8e6871d83b7ba9457c6e69f2b3aed1990e4e16b2164b8824208
Opcode Fuzzy Hash: 2aa776b202c6703ff31966c23dacd79a036964c0d6e59ac51e2dfd83685ece15
Instruction Fuzzy Hash: CB2144B1C0461A8FCB10CF9AC5447AEFBF4EF48224F06816AD919B7240D738A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 030BC8D8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 030BC952

Strings

{LfZ, xrefs: 030BC8EF

Memory Dump Source

Source File: 0000000C.00000002.924214440.00000000030B0000.00000040.00000001.sdmp, Offset: 030B0000, based on PE: false

Similarity

API ID: EncodePointer
String ID: {LfZ
API String ID: 2118026453-1558444270
Opcode ID: 78ad0cc51ee27f030189ccffe86a8bc4213f2f17e44ab789b5e12c616a35f0cd
Instruction ID: 9bf75faf5327461915eb3b427ada2c7bb81b63544c7b8e1aea15d2c1de6ee15e
Opcode Fuzzy Hash: 78ad0cc51ee27f030189ccffe86a8bc4213f2f17e44ab789b5e12c616a35f0cd
Instruction Fuzzy Hash: 681189B19013058FEB10CFAAC5497DEBBF8EB58314F148829D845A7740C738A8458FA5

Uniqueness

Uniqueness Score: -1.00%

Function 061DEBD0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 061DF31D

Strings

{LfZ, xrefs: 061DF2E2

Memory Dump Source

Source File: 0000000C.00000002.927713328.00000000061D0000.00000040.00000001.sdmp, Offset: 061D0000, based on PE: false

Similarity

API ID: Initialize
String ID: {LfZ
API String ID: 2538663250-1558444270
Opcode ID: 4c6cc363e3a2824b7d0561ed48709781d9676f7dd97a952767a5e146cbd6ae51
Instruction ID: e6765c0bbd4ec92d2f2c188af49464a2add2fa23cf5396c82c4dca9926fe491d
Opcode Fuzzy Hash: 4c6cc363e3a2824b7d0561ed48709781d9676f7dd97a952767a5e146cbd6ae51
Instruction Fuzzy Hash: 311145B0D002488FDB10CF9AD5887DEBBF4EB48324F10841AD51AB3300C378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145D450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923296830.000000000145D000.00000040.00000001.sdmp, Offset: 0145D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6740ad4d70e5933de2254ba061030bbab046252d5977fdeafa7168e7df8546d
Instruction ID: aee628153398d8fe169d30612d8f74edb7f47da49e9a8452f4ccf44ec73b6c8f
Opcode Fuzzy Hash: d6740ad4d70e5933de2254ba061030bbab046252d5977fdeafa7168e7df8546d
Instruction Fuzzy Hash: 6B2124B1904204EFDB45DF54D8C0B67BF65FF84328F24856ADD054B217C336E846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923296830.000000000145D000.00000040.00000001.sdmp, Offset: 0145D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e887739c6d40fd4c259f233715e0156fd87d5cfbaa72cccb2990f627fa5495
Instruction ID: 8de35ae654c7ae44eb47a5c1f7100cb9c9c042bc41e326a56599d29ed836d4c6
Opcode Fuzzy Hash: e5e887739c6d40fd4c259f233715e0156fd87d5cfbaa72cccb2990f627fa5495
Instruction Fuzzy Hash: D421F4B1904248DFDB45DF54D8C0B27BB65FF84328F2485AAED094B267C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0146D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923475993.000000000146D000.00000040.00000001.sdmp, Offset: 0146D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d91f93a7a90e9666e44148da947f249e7f26532e5b87491cb485c9eeb5dfc4
Instruction ID: 5556d58ab5ce268dd31bd888e2150d32ec2f7e9a9f2670da30d520d445ad1fbc
Opcode Fuzzy Hash: c1d91f93a7a90e9666e44148da947f249e7f26532e5b87491cb485c9eeb5dfc4
Instruction Fuzzy Hash: 122125B5A04240DFDB15CF64D8C0B26BB69FB8435CF24C56AD98A4B356C33AD807CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0146D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923475993.000000000146D000.00000040.00000001.sdmp, Offset: 0146D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e43129f4e4ad0e064bdde8ea5e3a1f3529970031d9f136b38f73bf1e9bb095b
Instruction ID: 5ea3b18560025bcff48569e56851f0af65b4b74cb39a0dc07f6fd4df2d3381ed
Opcode Fuzzy Hash: 6e43129f4e4ad0e064bdde8ea5e3a1f3529970031d9f136b38f73bf1e9bb095b
Instruction Fuzzy Hash: 432162755093808FDB13CF24D594B16BF71EF46218F28C5DBD8898B667C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0145D44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923296830.000000000145D000.00000040.00000001.sdmp, Offset: 0145D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction ID: 61eec372ef215636d23ec0fe0dc594f0f161eb71e99fc473cac2e44be3479adf
Opcode Fuzzy Hash: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction Fuzzy Hash: 69119D76804284CFDB16CF54D5C4B1ABF71FB84328F2886AADC454A627C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.923296830.000000000145D000.00000040.00000001.sdmp, Offset: 0145D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction ID: cdad893a4d85e700c66d3859392bd496f171acac7a80e6b2178ccbf4c53e64ba
Opcode Fuzzy Hash: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction Fuzzy Hash: F6119D76804284CFCB46CF54D5C4B16BF62FB84224F2886AAD8494B627C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: MLdAu.exe PID: 1868 Parent PID: 3424 MLdAu.exeCOMMON

Executed Functions

Function 08CC0C28, Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050dd480783a4ea8256e472dcb4a688f5f600b72fb085f2847aabf62d08550e8
Instruction ID: 7e4fc9dd7521f2e7e5f1c7ae0c38802a69140da07cc6b64062574dbb0e03360d
Opcode Fuzzy Hash: 050dd480783a4ea8256e472dcb4a688f5f600b72fb085f2847aabf62d08550e8
Instruction Fuzzy Hash: DF91F674E002589FDB54DFB5D941B9DBBB2FF89300F2080AAE519AB366DB349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08CC0FC0, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bd0bdd83a9f32f2c1e30cd690296c6540ae164fc92b206cafeefc0dd8f2b06
Instruction ID: 327246e3a81e879093b04b2635e3a7e60e4f28c77a2f3e253e7783c90dcfc629
Opcode Fuzzy Hash: 91bd0bdd83a9f32f2c1e30cd690296c6540ae164fc92b206cafeefc0dd8f2b06
Instruction Fuzzy Hash: 6081E574E002189FDB58DFA5D985B9EBBF2FF89300F208069E519AB365DB349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0117B680, Relevance: 6.1, APIs: 4, Instructions: 127threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0117B6F0
GetCurrentThread.KERNEL32 ref: 0117B72D
GetCurrentProcess.KERNEL32 ref: 0117B76A
GetCurrentThreadId.KERNEL32 ref: 0117B7C3

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 926c584ba97421e610b12d624e95bf728b50c349bcadf7f4f213c9ef1683b407
Instruction ID: c744da6738576ebb42e5532412cc2774a5237509b72dfb4b7ced016570746a3f
Opcode Fuzzy Hash: 926c584ba97421e610b12d624e95bf728b50c349bcadf7f4f213c9ef1683b407
Instruction Fuzzy Hash: 855154B4D046488FDB14CFAAC6887EEBFF0BF48314F248499E459A73A0C7346845CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0117B690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0117B6F0
GetCurrentThread.KERNEL32 ref: 0117B72D
GetCurrentProcess.KERNEL32 ref: 0117B76A
GetCurrentThreadId.KERNEL32 ref: 0117B7C3

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 970d4ffe0aad7c5f071385cfeb767b02de36d711da61d0e4a183ad5804b8556b
Instruction ID: e591134aacc46c2899804597901be2a66c027cb83c5eb0260f750c592051fedd
Opcode Fuzzy Hash: 970d4ffe0aad7c5f071385cfeb767b02de36d711da61d0e4a183ad5804b8556b
Instruction Fuzzy Hash: 8E5133B4D04649CFEB14CFAAC688BEEBBF4BB48314F248459E419A73A0C7346944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01179690, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011798D6

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d182350d0653e8d8a093bc94f563cf1317838cb71d1330e0ec58272fab7691ff
Instruction ID: 28a77ac307309be94191edcc0b584d696b149b0f9039e6c5c95e2686161f4ee3
Opcode Fuzzy Hash: d182350d0653e8d8a093bc94f563cf1317838cb71d1330e0ec58272fab7691ff
Instruction Fuzzy Hash: B5712670A00B098FDB28DF2AD04579ABBF1FF88218F008929D54ADBB50D775E949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0117FCEC, Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0117FE0A

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bd98a13ba5112fb9c5921f6611dfd3bab500f40f43c9e6bb8cfd548e86b8cfe8
Instruction ID: 2e6d09d536d3ac5cb907e0676bf52162a83705f738b30841b4330df6e3866d27
Opcode Fuzzy Hash: bd98a13ba5112fb9c5921f6611dfd3bab500f40f43c9e6bb8cfd548e86b8cfe8
Instruction Fuzzy Hash: 1451E1B1D003599FDB14CFAAC884ADEBFB1FF48314F25852AE818AB211D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0117FCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0117FE0A

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9f8bc67eb8455ab9067a588840be39d706725dbd6f4e1d7696ce88d09de4cb95
Instruction ID: 97f893c7da16c46c18bd0021b7b0aa502385f0f671a99eab50d594cbf9d1f1bf
Opcode Fuzzy Hash: 9f8bc67eb8455ab9067a588840be39d706725dbd6f4e1d7696ce88d09de4cb95
Instruction Fuzzy Hash: 4C41C0B1D003199FDB14CFAAC884ADEBFB5FF48714F25852AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01175364, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01175421

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b8479cebaff130cdf271e461a556da260857c57726b9198268bdbe35b6953f9d
Instruction ID: b0e2659912bad6b8adee5fd8af9e3593c13747735fb67b17ed7d4d51d09d937e
Opcode Fuzzy Hash: b8479cebaff130cdf271e461a556da260857c57726b9198268bdbe35b6953f9d
Instruction Fuzzy Hash: 6C411471D04218CFEB24CFA9C884BDDBBB6BF99314F24806AD409BB251DBB55946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01173CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01175421

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 124d7360ea705dd865439b9e7f397b40b38610b165b6130e608b93dc3ee871e0
Instruction ID: a2f2aa05904506c94f424a049344ed14dba879e291d6af3f25483a69d302dcb7
Opcode Fuzzy Hash: 124d7360ea705dd865439b9e7f397b40b38610b165b6130e608b93dc3ee871e0
Instruction Fuzzy Hash: 7641E371D04218CBEB24DFA9C84479EBBB5BF59304F108069D509BB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01179AF2, Relevance: 1.6, APIs: 1, Instructions: 71libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01179951,00000800,00000000,00000000), ref: 01179B62

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 587c6dd05fd3d25146367e20b3502c13c10d4f5329c863c2b702564ce1a007a8
Instruction ID: 8f1853520971a430d4856fa6b2e360aea279a0278a4df2d1a15a20593be6b17f
Opcode Fuzzy Hash: 587c6dd05fd3d25146367e20b3502c13c10d4f5329c863c2b702564ce1a007a8
Instruction Fuzzy Hash: 6A2146B6D00248CFDF24DFAAD444AEEFBB4EB98364F15802AD555A7300C334A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117B8B2, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0117B93F

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c6d0896e664a2cc496dd161f908e23a5800c706c637e810a09abe06e48ca55e1
Instruction ID: d830b1fbbd82aa7686f74bcd18f2f02ad4e26e741ec57b8608b46c219b9ff289
Opcode Fuzzy Hash: c6d0896e664a2cc496dd161f908e23a5800c706c637e810a09abe06e48ca55e1
Instruction Fuzzy Hash: 942103B59002489FDB10CFAAD584BEEBFF4EB48320F14801AE954A3310D378A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0117B8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0117B93F

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f2a8fa5b526ca361710f6a855187ed0dc1c1b04916a27e77b1d26aecfd042865
Instruction ID: 041c6a91f1a71679e46bd75666c0d9d9b3fe2f6b172d1bd54197df383596550f
Opcode Fuzzy Hash: f2a8fa5b526ca361710f6a855187ed0dc1c1b04916a27e77b1d26aecfd042865
Instruction Fuzzy Hash: 2121E4B59002199FDB10CF9AD584BDEBFF8EB48324F14841AE914A3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011792A8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01179951,00000800,00000000,00000000), ref: 01179B62

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d0ebfe7aad6604ae35bf6881a0d845d934a08beca86e3c8821a0fc82e6cf839
Instruction ID: 25219ae0e629ebf13bb87d3aec100863c7fea0543d4ac867d6a7ccf04a6e0ad8
Opcode Fuzzy Hash: 8d0ebfe7aad6604ae35bf6881a0d845d934a08beca86e3c8821a0fc82e6cf839
Instruction Fuzzy Hash: 6B1103B69002498FDB14CF9AC444BEEFBF4AB58324F15842AD515A7300C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01179870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011798D6

Memory Dump Source

Source File: 00000011.00000002.922862430.0000000001170000.00000040.00000001.sdmp, Offset: 01170000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1fdc12ab3533d5a0f36d6f663eb47a50c53cfaa936f4227a216551ed42cce8ef
Instruction ID: 4b18c7188fcdcdc37b6e5fe4c79e9e60104de8b5acd1c3c1408abede39e20199
Opcode Fuzzy Hash: 1fdc12ab3533d5a0f36d6f663eb47a50c53cfaa936f4227a216551ed42cce8ef
Instruction Fuzzy Hash: 1C11CDB5C002498BDB14CF9AD444BDEBBF8AB89224F14842AD929A7600C378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08CC0A20, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fede1fa65613a1ca4bf812908f793e41cdbda645a654cba7c1d4db6e453ba1
Instruction ID: 749c8d3d502381f44b566a15b1bf71193b254e462e84b8f35bb303d263fcc8a6
Opcode Fuzzy Hash: 95fede1fa65613a1ca4bf812908f793e41cdbda645a654cba7c1d4db6e453ba1
Instruction Fuzzy Hash: A3310174E012599FDB05DFA9D580AEEBBB2FF89300F15806AE815B7361DB345902CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08CC0A30, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6454ff55acb8a1757267b1475a46127e18d4dff96a1bb7156c049d9d87db48ee
Instruction ID: 185185634a8b83ea6e17d2b955fa354dfdf4f2f32372aab350bf78eaaf2585aa
Opcode Fuzzy Hash: 6454ff55acb8a1757267b1475a46127e18d4dff96a1bb7156c049d9d87db48ee
Instruction Fuzzy Hash: 56319E74E016199FDB04DFA9D540AEEBBB2FF89304F10802AE815B7354DB355942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08CC08F0, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74df8cd6b048f7e7ebbf1f6c7f35f6147352c871627721fc5a2d7127da40ec77
Instruction ID: 53dd3747d3a87afadce1cda1acd432259c3dd81159ddde5275073a7d8d003fee
Opcode Fuzzy Hash: 74df8cd6b048f7e7ebbf1f6c7f35f6147352c871627721fc5a2d7127da40ec77
Instruction Fuzzy Hash: 8A312374E016098FDB05CFBAD8405EEBBB2FF89210F14806AD404BB360DB355942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08CC0500, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1dab5a8f12f7a7aef089f4eaae6fff1732b6c02fbc13f56cab36f76cf41810
Instruction ID: 5a0567985e49783b158a0ef3fbe04e6e550bf527b037545ec31fd354e6c1db0f
Opcode Fuzzy Hash: 6c1dab5a8f12f7a7aef089f4eaae6fff1732b6c02fbc13f56cab36f76cf41810
Instruction Fuzzy Hash: C6319E74E05609CFCB48DFAAD5456EEBBF5BB8C201F10846AE819B7350E7345A41CF68

Uniqueness

Uniqueness Score: -1.00%

Function 08CC04F1, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4152043afa89fdec02f1d6f8fb55fd0a53f73d2302002778ca282dc12f511b
Instruction ID: 3869fceda6c98a3f6b0587a5e837551bb242bac63541943c6c8e7cc16b16c056
Opcode Fuzzy Hash: 5f4152043afa89fdec02f1d6f8fb55fd0a53f73d2302002778ca282dc12f511b
Instruction Fuzzy Hash: 1C31DEB0D09609CFCB09DFAAD5446EEBBF1BB8D301F1484AEE419A7250E7345A41CF68

Uniqueness

Uniqueness Score: -1.00%

Function 08CC05F1, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a5a0e8994dfc643a6c5e99b54a6448ee7e8637a28e53d5af36a878f8b6606e
Instruction ID: c5c5c20dd35703173de00cee6463a73e4b6241785f4763b1e10585133a452e1e
Opcode Fuzzy Hash: a2a5a0e8994dfc643a6c5e99b54a6448ee7e8637a28e53d5af36a878f8b6606e
Instruction Fuzzy Hash: C631A2B4D0560ACFCB54DFA9C5816EEFBF1BF89304F2491AAD804B7251E7349A41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08CC09C0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8862b07fffbc0f284be4573bc23c97c2ba2809fce85b341b3bec1e166067bcb
Instruction ID: 14dc9ec259aef9537236f2eeced8fba35d2db1da4617b700f4c61836805af609
Opcode Fuzzy Hash: b8862b07fffbc0f284be4573bc23c97c2ba2809fce85b341b3bec1e166067bcb
Instruction Fuzzy Hash: 94113734E05648DFCB54CFA9E584A9DBBB1FF4A311F1481AAE408AB361DB349905CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08CC02DA, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995b3afdda3ccc8d76bc9c7ffb8030c0dd25824a055bf7b0ab5092f9b5e1a9cf
Instruction ID: 680ae155f666953fbb5523a0edf8e99daff22345552303b7ded82e64c755d376
Opcode Fuzzy Hash: 995b3afdda3ccc8d76bc9c7ffb8030c0dd25824a055bf7b0ab5092f9b5e1a9cf
Instruction Fuzzy Hash: 67112B74B006058FCB14DF69D585AAAFBF5FF88214B2485AEE509D7321DB31AD068B90

Uniqueness

Uniqueness Score: -1.00%

Function 08CC02E8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b857494be4e131bcca31d55c323c241338efd87f711a7ecfa50d87082cfc26c8
Instruction ID: ecdb1ed0669ec2752e9a9079e06a431526db1110031ff5a81e49299464c5261b
Opcode Fuzzy Hash: b857494be4e131bcca31d55c323c241338efd87f711a7ecfa50d87082cfc26c8
Instruction Fuzzy Hash: FC110A74B006158FCB04DF69D5849AAFBF5FF88614B2485ADE909D7321EB31ED068B90

Uniqueness

Uniqueness Score: -1.00%

Function 08CC0288, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c9096634c25eab6533827667019c70524abdc66519f21feea9a1b79926fa46
Instruction ID: b4bad22d7954a26100a33a3f0c6cc6acf26683538d8729727ffbdc7c94886b1c
Opcode Fuzzy Hash: 35c9096634c25eab6533827667019c70524abdc66519f21feea9a1b79926fa46
Instruction Fuzzy Hash: B9E0D831204B198BE6149765D4417E233A5DF4431CF084429D48AD7719CB65B4578784

Uniqueness

Uniqueness Score: -1.00%

Function 08CC027A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.943518847.0000000008CC0000.00000040.00000001.sdmp, Offset: 08CC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8217e2b254500b91ef55bbfbdbe4e1f1d332a400ca083d86bbcd88d6b39e494
Instruction ID: 3dc09729f183e480a2072634556f3a27f44adf3a73912507b4bc08f8817730dc
Opcode Fuzzy Hash: b8217e2b254500b91ef55bbfbdbe4e1f1d332a400ca083d86bbcd88d6b39e494
Instruction Fuzzy Hash: F1E07D32204B15DBE72442B9D4027F43720DF40318F0C407EC4CFC7705CA5558578750

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: MLdAu.exe PID: 6280 Parent PID: 3424 MLdAu.exeCOMMON

Executed Functions

Function 09100FBA, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d3046c0d82e2b1fa2e117dd8d69b53414877e21a7fed75950af4edc099ac17
Instruction ID: 18cf2efa9912b49d230bd8590f1456219f06d3e46f7069745e9c512da3035a8c
Opcode Fuzzy Hash: 69d3046c0d82e2b1fa2e117dd8d69b53414877e21a7fed75950af4edc099ac17
Instruction Fuzzy Hash: 6F81C374E002189FDB58DFA5D894B9EBBB2FF89304F20806AE519AB364DB305D42DF50

Uniqueness

Uniqueness Score: -1.00%

Function 09100FC0, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd180e351b7cad7f95c939fa7e55ef6bcdc5cac08c9bd358dfe2335b0c5ad8e4
Instruction ID: b16ec466040e35455e43e235212ea343fbb4099f83ae09593db001927e265a55
Opcode Fuzzy Hash: cd180e351b7cad7f95c939fa7e55ef6bcdc5cac08c9bd358dfe2335b0c5ad8e4
Instruction Fuzzy Hash: D181C274E002189FDB58DFA5D894B9EBBB2FF88304F20806AE519AB364DB305D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DE9690, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DE98D6

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bab2d55971e4c19883bab09f5a3998684d92dc1fdbeaf2392af1c6b4f351aec9
Instruction ID: dc0a91f675c0b99d544c25b490f2316d5ebafac17106eed457226199e968d654
Opcode Fuzzy Hash: bab2d55971e4c19883bab09f5a3998684d92dc1fdbeaf2392af1c6b4f351aec9
Instruction Fuzzy Hash: CC7113B0A01B058FDB24EF29D15579AB7F6FF88204F10892ED49AD7B50DB74E809CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DE5364, Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02DE5421

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6e4d773dcb61a81cb6d51b19d93d9c0a2cff348b13d8e5426a5608d0ab8af509
Instruction ID: d201ee5233fe75b3f4aacd8481b4cbdea09ab2da3f4fe163711ed7366e72c97e
Opcode Fuzzy Hash: 6e4d773dcb61a81cb6d51b19d93d9c0a2cff348b13d8e5426a5608d0ab8af509
Instruction Fuzzy Hash: A2511271D00219CFDB10DFA9D9847DEBBB1BF49318F64806AD409AB251DB785946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DEFCEE, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DEFE0A

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1fb90c4b89df1762c3c8f63d58832f75b4734fffeed79b93f0e066f1c395cc71
Instruction ID: abb2a65047a779ef7a109958b2758d0ae5a6932620eecfc66576add5b52ca197
Opcode Fuzzy Hash: 1fb90c4b89df1762c3c8f63d58832f75b4734fffeed79b93f0e066f1c395cc71
Instruction Fuzzy Hash: 0751CEB1D002099FDF14DFAAC884ADEBFB5FF48314F25812AE819AB211D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DEDC64, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DEFE0A

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c6ffc364972aff7b1c93c2b4e18a90ca8ba5ed2997f6b34032807d6da5768b8f
Instruction ID: c47e36d2c2323d806cf13f54fdd3d81fc5feff4165bcf4aeb57e41013916f89e
Opcode Fuzzy Hash: c6ffc364972aff7b1c93c2b4e18a90ca8ba5ed2997f6b34032807d6da5768b8f
Instruction Fuzzy Hash: B851DEB1D003099FDF14DFAAD884ADEBBB5FF48314F64812AE819AB250D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02DE3CAC, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02DE5421

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 292871ac159195f42d090ca07fe0b160417708b46375b6f402e57b4334e11b5e
Instruction ID: 3f70c381bf19598e50af01d32369727a39f8dfc51667f783eefa8f803da3d328
Opcode Fuzzy Hash: 292871ac159195f42d090ca07fe0b160417708b46375b6f402e57b4334e11b5e
Instruction Fuzzy Hash: 02410270C00229CBDF24DFA9D884BCEBBB5BF49308F508069D409BB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 075EBA1C, Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,075ED0ED,?,?), ref: 075ED19F

Memory Dump Source

Source File: 00000013.00000002.933223425.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 10d15924dec05090611958f6dfb40b019e5d690f5893f2fba28c3e2373004142
Instruction ID: eeb8a267949debe658f06a5e5687109edf71c1bd0ff6c24ba2f1e546385dc634
Opcode Fuzzy Hash: 10d15924dec05090611958f6dfb40b019e5d690f5893f2fba28c3e2373004142
Instruction Fuzzy Hash: 6F31C3B5E013099FDB14DFAAD8846DEBBF9FB58320F14842AE915A7310D774A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 075ED100, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,075ED0ED,?,?), ref: 075ED19F

Memory Dump Source

Source File: 00000013.00000002.933223425.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a512eaf1df8d5f8405d83a4fde2ecd38ce028fbb711a0957d258151fcfb1d0a3
Instruction ID: f42d76712439fda78a5ad51d3c62e505611c66872e445af4d94b03f3f14d98f2
Opcode Fuzzy Hash: a512eaf1df8d5f8405d83a4fde2ecd38ce028fbb711a0957d258151fcfb1d0a3
Instruction Fuzzy Hash: E631C0B5E0134A9FDB04CFA9D8846DEBBF5BB58324F14842AE819A7310D774A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DE9630, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02DEB87E,?,?,?,?,?), ref: 02DEB93F

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 944c098ca7f77c588ed7a69c1532e62c3386ed0366cba01a140b9fbc26e9082c
Instruction ID: 8889778f7ee499d5bfe82a6e98eee53aea695c7ecab42652935ee6b993d8c4ed
Opcode Fuzzy Hash: 944c098ca7f77c588ed7a69c1532e62c3386ed0366cba01a140b9fbc26e9082c
Instruction Fuzzy Hash: DA2103B59012199FDB10CFAAD984BDEBBF8FB48324F14802AE915A3310D374A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DEB8B2, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02DEB87E,?,?,?,?,?), ref: 02DEB93F

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22d9c149bcd21fe97e27d77a82582e2d2f5884cf58158e3b650d5f04362a2192
Instruction ID: ace7734bb2b06a016438ab3876003a52ef16081c2d2e468950751294b6902c58
Opcode Fuzzy Hash: 22d9c149bcd21fe97e27d77a82582e2d2f5884cf58158e3b650d5f04362a2192
Instruction Fuzzy Hash: 6E21E3B5901219AFDB10CF9AD984BDEBBF8FB48324F14841AE914A3350D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075E48F8, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 075E496A

Memory Dump Source

Source File: 00000013.00000002.933223425.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 4aa450f7344575e4296c708682aeb92f9bddcbd95c55b7091b8b40270cde5d2c
Instruction ID: 80e65031e2cc15c5177e09ea1e509a6c39e33debec13f4ff3415aaed0aaf2a35
Opcode Fuzzy Hash: 4aa450f7344575e4296c708682aeb92f9bddcbd95c55b7091b8b40270cde5d2c
Instruction Fuzzy Hash: FD2103B6C002599FDB14CF9AD444BEEBBF8FB88320F14846AE854B7240D738A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DE92A8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02DE9951,00000800,00000000,00000000), ref: 02DE9B62

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6c85fc798d3bb12f1f551e1b961830a6b9f4e92a1d25c34fd68b20f4c2a18377
Instruction ID: 745cfd5f49f8532abd1f73b5ff5683be4dac1966c3f7242c14a55420f2c9e2e9
Opcode Fuzzy Hash: 6c85fc798d3bb12f1f551e1b961830a6b9f4e92a1d25c34fd68b20f4c2a18377
Instruction Fuzzy Hash: D81133B6D012098FDB10CF9AC484BDEFBF4EB48314F00842AE816A7300C774A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DE9AF2, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02DE9951,00000800,00000000,00000000), ref: 02DE9B62

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f2f394418b1d5584e645d91b4d8e5416f1c7f01b71315e7687988133096cdb5
Instruction ID: d1a95d1103f09b3f36d0a42987ccb85d89e2a8008af1923f107ef5001e2c10d8
Opcode Fuzzy Hash: 9f2f394418b1d5584e645d91b4d8e5416f1c7f01b71315e7687988133096cdb5
Instruction Fuzzy Hash: 911126B6D012198FDB10CF9AD484BDEFBF8EB88324F05852AD415A7700C778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075E4900, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 075E496A

Memory Dump Source

Source File: 00000013.00000002.933223425.00000000075E0000.00000040.00000001.sdmp, Offset: 075E0000, based on PE: false

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 38960875e8d6f2f41a6cc1c91c1fbfb2aec05588c2345932932308c8e3cb1e2f
Instruction ID: 2445ac3fd99881ec36bb90fb2b3adcfc8a9a5b2b5d17aa3ffc646573f6258a90
Opcode Fuzzy Hash: 38960875e8d6f2f41a6cc1c91c1fbfb2aec05588c2345932932308c8e3cb1e2f
Instruction Fuzzy Hash: 491100B6C002498FDB14CF9AC444BDEBBF8EB88320F04846AE858B3200D338A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DE9870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DE98D6

Memory Dump Source

Source File: 00000013.00000002.923665463.0000000002DE0000.00000040.00000001.sdmp, Offset: 02DE0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fc911a316797935f26027f587828c9c55ef4309a3cad007bc6346a0cd489a4b8
Instruction ID: e268e738b8ce7986d68f74ea3a7a342228c3c4ec9da97923baba19abc185c9ed
Opcode Fuzzy Hash: fc911a316797935f26027f587828c9c55ef4309a3cad007bc6346a0cd489a4b8
Instruction Fuzzy Hash: A31102B5C012498FDB10DF9AD444BDEFBF8EB88324F14846AD829A7310D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09100A20, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b34f1959f4a91ea0d2714368e2970e6c361a9fb7bbc6f9b99beacbe987ff2d7
Instruction ID: 7b7e177f32bcf8693b0db6072c1d6989b3dc35702a95c864af10003a3924a1a7
Opcode Fuzzy Hash: 9b34f1959f4a91ea0d2714368e2970e6c361a9fb7bbc6f9b99beacbe987ff2d7
Instruction Fuzzy Hash: DC31EFB4E012199FDB08DFA8D550AEEBBB2FF89300F11806AE814B7354DB355942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 09100A30, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0437c9ca45389aaa4da134a534033264d00d08d3938372a6d8c2d71137441f51
Instruction ID: c88a887018ee42ffccbfb9e018593cdb574190c8284c0c265e9af416449bd71c
Opcode Fuzzy Hash: 0437c9ca45389aaa4da134a534033264d00d08d3938372a6d8c2d71137441f51
Instruction Fuzzy Hash: 5031BCB4E012199FDB08DFA9D450AEEBBB2FF88300F10802AE815B7354DB355942DF91

Uniqueness

Uniqueness Score: -1.00%

Function 091004F1, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902e9430dc2f44666772e249a43e16832a388866749314ce9463a390a22cb0fe
Instruction ID: 90962dbb8223f1f6f992692d0c28a2c63aac06c6b4f043130d68af9f09238d3c
Opcode Fuzzy Hash: 902e9430dc2f44666772e249a43e16832a388866749314ce9463a390a22cb0fe
Instruction Fuzzy Hash: DC31FEB0E05209CFCB08DFAAC4556EEBBF1BB8D304F10806AE415B7291EB745A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 09100500, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c39236ade838f0389869bc381fffaa256459147c48356edb40f8fdcad58e6c6
Instruction ID: 8e9681f318639e57797386f834b4439ea672d81c69462714efdfa3e2b96152b2
Opcode Fuzzy Hash: 0c39236ade838f0389869bc381fffaa256459147c48356edb40f8fdcad58e6c6
Instruction Fuzzy Hash: 5631ABB4E05209CFCB18DFAAC5556EEBBF1BB8D304F10802AE815B7290EB755A41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D8D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923131278.0000000002D8D000.00000040.00000001.sdmp, Offset: 02D8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e928c3f79cdc9597f5a9e8c36683e4591eab7a9df2a02b631ea6a5c45d01c4
Instruction ID: 0ae692a28752cb6c1f96c012e200bbd96a5a8401e7c7a0d27a84531a5924f198
Opcode Fuzzy Hash: 09e928c3f79cdc9597f5a9e8c36683e4591eab7a9df2a02b631ea6a5c45d01c4
Instruction Fuzzy Hash: B321D6B1504244DFDB05EF24D9C0F26BBA6FB84318F2485AAD9454B3C6C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 091008F0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82b5942ee6bb1e41d62c187a4caaa754108573212c0a14624b5307b625169b5
Instruction ID: 772622a3fa2905b59794b53f03977657e6a0e8fdb58293469676435d85da81ce
Opcode Fuzzy Hash: d82b5942ee6bb1e41d62c187a4caaa754108573212c0a14624b5307b625169b5
Instruction Fuzzy Hash: D62135B5E012098FCB08CFA9D9406EEBBB2FF89314F15806AD504B7350DB355902CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D9D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923299285.0000000002D9D000.00000040.00000001.sdmp, Offset: 02D9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846c76e2b6527302b92b8ec7426f61b904d93f238726bec81a377dae048ef74b
Instruction ID: 2a28627115f11dd6de126ce938705b8da104ebafc28bec921f9299c4159a7716
Opcode Fuzzy Hash: 846c76e2b6527302b92b8ec7426f61b904d93f238726bec81a377dae048ef74b
Instruction Fuzzy Hash: 8821CFB56082449FDF14EF24D8C4B26BB66EB84214F34C6A9E94A4B346C73AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02D9D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923299285.0000000002D9D000.00000040.00000001.sdmp, Offset: 02D9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f061320515b9b040eb1c1f934b0554cc9b0c99694dc50a06a2beac0c5d5ef101
Instruction ID: d0266154077aa8506357f63c76fbd2a85cb034972ce3923853012a8e4f8818ac
Opcode Fuzzy Hash: f061320515b9b040eb1c1f934b0554cc9b0c99694dc50a06a2beac0c5d5ef101
Instruction Fuzzy Hash: F52107B5504204EFDF05EF50D5C0B26BB66FB84318F24C6A9E9494B346C73ADC46CA61

Uniqueness

Uniqueness Score: -1.00%

Function 09100600, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e7716caa4214e6445b8689550bb15d00ea7e4dfa88aa0b16eb0047012ba704
Instruction ID: 8292f6df0bdf8122070cdbacb12a360dc39170769571dd5580806aac0b774bec
Opcode Fuzzy Hash: b9e7716caa4214e6445b8689550bb15d00ea7e4dfa88aa0b16eb0047012ba704
Instruction Fuzzy Hash: 1721BFB4E01209CFCB44DFA9C5816EEFBF2BB88304F20916AD408B7250E7759A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 09100900, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5988cb490da148291a87f3da37b44bd772d300b88b8a003f8fe10836b7389b61
Instruction ID: b06bc1c266d8116faa88844d60b141230929131a35a4e9a7da3eafb365a1735e
Opcode Fuzzy Hash: 5988cb490da148291a87f3da37b44bd772d300b88b8a003f8fe10836b7389b61
Instruction Fuzzy Hash: 0421DF74E016199FDB08DFAAD840AEEBBB2FF89304F10806AE505B7360DB355941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D9D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923299285.0000000002D9D000.00000040.00000001.sdmp, Offset: 02D9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b995f594192dd483d4ee512676a7a688687f8903b2df2339912c34bf4b80d2f2
Instruction ID: 38ada394ccca82be7afe0e96d0df032fb7ae14632c4e0170f24bdd0b198b1200
Opcode Fuzzy Hash: b995f594192dd483d4ee512676a7a688687f8903b2df2339912c34bf4b80d2f2
Instruction Fuzzy Hash: DE2192755093C08FCB02DF24D594715BF71EB46214F28C5DAD8898B697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 091002DA, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd18936c64fb2c0f295d125480c9180dc93d1fcfb9239fb1b6ecedbad6d0f77
Instruction ID: 1030fad678fcf7764d3dcc1b80683bee7470ba371583c47360ab7282d8eeb028
Opcode Fuzzy Hash: 2dd18936c64fb2c0f295d125480c9180dc93d1fcfb9239fb1b6ecedbad6d0f77
Instruction Fuzzy Hash: 86117974B002059FCB04DF69D4849AAFBF5FF89610B2481AAE909D7321DB31AD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 091005F1, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c394fa9a43e1f204b6bef23acfd454de68a3a36ff5bd5a3ef9fc9a16bbba9a9f
Instruction ID: 9f43466c8809d7d1e1e7a4674ecc6b119f7a51bb866a44e5c545a33922f37f17
Opcode Fuzzy Hash: c394fa9a43e1f204b6bef23acfd454de68a3a36ff5bd5a3ef9fc9a16bbba9a9f
Instruction Fuzzy Hash: 2A21D0B4E09209CFCB44CFAAC5416AEFBF1BF89304F1481AAD458A7251E7748A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02D8D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923131278.0000000002D8D000.00000040.00000001.sdmp, Offset: 02D8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction ID: f85b4f309b9cf9852faa137b4dbb7a45a9e92cf6a40471ac0d7768c170213f9d
Opcode Fuzzy Hash: 8d778767f53fd0a6c663cb8d613203c36db215e48ccc3c7032546bce1bc62798
Instruction Fuzzy Hash: 3811D376404280DFCB11DF10D5C4B16BFB2FB85324F28C6AAD8450B796C33AD856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 091002E8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17367c65d63fdebb36f81dc076660315caafad3acfad45373186ef2fd788e98d
Instruction ID: 236019aceb6aab616a954011f60c897174a6d75d254a055f106cb3a5a2aa78ca
Opcode Fuzzy Hash: 17367c65d63fdebb36f81dc076660315caafad3acfad45373186ef2fd788e98d
Instruction Fuzzy Hash: 60113A74B002159FC704DF69D4849AEFBF5FF8D614B208569E909D7321EB31ED028B90

Uniqueness

Uniqueness Score: -1.00%

Function 02D9D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923299285.0000000002D9D000.00000040.00000001.sdmp, Offset: 02D9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction ID: 839ef52b9483b3e5d9a7f2252fd6256154c77706e1ef1e499a3391a00fa9fea4
Opcode Fuzzy Hash: 06a7eb2830fe3889e456d27655020f58fd7942a7660a67a9db2bbc7502f19bed
Instruction Fuzzy Hash: 0D118B75904280DFCF11DF10D5C4B15BBB2FB84224F28C6AAE8494B796C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 091009C0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6895d369f3d1756a40b94f69271148554c7612283907579cc592f04997e3175c
Instruction ID: b8922a26636b135d23a128ca46ba3df9dff606f1c52705dcb755ad8cfac1c401
Opcode Fuzzy Hash: 6895d369f3d1756a40b94f69271148554c7612283907579cc592f04997e3175c
Instruction Fuzzy Hash: 27018834E042488FC704DFA5E419A5EBFB1FB8A305F1182EAE848D73A1D3358D42CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02D8D6CF, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923131278.0000000002D8D000.00000040.00000001.sdmp, Offset: 02D8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ded658b1952af79427ae3348b858202139c6fcb86f9ebb4825609a128bef5e
Instruction ID: 6acbfa24aa364d9a19e5e036c6fbc6f3f8d76863769ebec286d7740748c62230
Opcode Fuzzy Hash: 50ded658b1952af79427ae3348b858202139c6fcb86f9ebb4825609a128bef5e
Instruction Fuzzy Hash: A0F0F976601614AF97209F0AD885C27FBADEBC4770715C59AE84A4B752C671EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D8D6C0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.923131278.0000000002D8D000.00000040.00000001.sdmp, Offset: 02D8D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b60b45fa855597cead97b36a60478c28509e25c76d8ae9d8419ada9519db58c
Instruction ID: 43b92d26562dae21ac2e72e6fd6820a0a484054b60b707ee2beec972afc8edbe
Opcode Fuzzy Hash: 1b60b45fa855597cead97b36a60478c28509e25c76d8ae9d8419ada9519db58c
Instruction Fuzzy Hash: DAF03C75105680AFD3258F16C884C22BFB9EB866607198489E8894B352C630FC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 091009D0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c24a90ae4e7ef840fc190a7e2d75d39f97ca9abf1453fed5cd0b2284873fdc9
Instruction ID: 98ef8f23990510de79b3a11b80c6f1b85714c65ec1a3c56c3c339609605c1251
Opcode Fuzzy Hash: 5c24a90ae4e7ef840fc190a7e2d75d39f97ca9abf1453fed5cd0b2284873fdc9
Instruction Fuzzy Hash: A9F0F874E00208DFC744DFA9E545A9EBBF5FB89305F1081A9D818A3354EB359E05CF51

Uniqueness

Uniqueness Score: -1.00%

Function 09100288, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7338de4e9653a46677b2a80b9913d8c028485faf9e73d73062506619efe1c9
Instruction ID: 0f23406a3802420c77357cd31e21077d1f211a68ba272d605c2f84e624bdd999
Opcode Fuzzy Hash: 6f7338de4e9653a46677b2a80b9913d8c028485faf9e73d73062506619efe1c9
Instruction Fuzzy Hash: B9E0683130070C8BE6189768C411BE63365DF4431CF080031D489C7368CBAAB8568384

Uniqueness

Uniqueness Score: -1.00%

Function 0910027A, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.943838465.0000000009100000.00000040.00000001.sdmp, Offset: 09100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f129c848d27935ab44844113071b1a07fd20ddd2d699ad4cd290d41af75624e
Instruction ID: 8c7db9dfaa8980c278f7110175e7df0d90b9f24f532c4d03e020bfbefd5454df
Opcode Fuzzy Hash: 7f129c848d27935ab44844113071b1a07fd20ddd2d699ad4cd290d41af75624e
Instruction Fuzzy Hash: 92E026327097444FE31A56A098227F53B209F82318F0D44A7D488C7AAAC65D6C5A8782

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report kwFDCU89PZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: kwFDCU89PZ.exe PID: 7132 Parent PID: 5776