Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.27244

Overview

General Information

Sample Name:	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.27244 (renamed file extension from 27244 to exe)
Analysis ID:	502297
MD5:	a665b705b9381b33aaa9e307fe340af7
SHA1:	a6fba4f009921b1de9d524047bcb7fa0e571a116
SHA256:	dc07322ef1652695b5e85bfd5d6da8c5b6c311d26ff13eb18a390cd4b7232203
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected AgentTesla

Yara detected AntiVM3

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe (PID: 4608 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe (PID: 5252 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 5328 cmdline: 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 5476 cmdline: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 7036 cmdline: 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@croatiahunt.com", "Password": "VilaVrgade852", "Host": "mail.croatiahunt.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BnevyAj.exe PID: 5328	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 5328	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BnevyAj.exe PID: 5476	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 5476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
14.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.428bd80.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.428bd80.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.2591524.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.BnevyAj.exe.37e5230.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37e5230.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37e5230.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37e5230.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4234960.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4234960.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.3131990.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.BnevyAj.exe.36ebd80.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.36ebd80.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.3694960.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.3694960.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 11.2.BnevyAj.exe.37e5230.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@croatiahunt.com", "Password": "VilaVrgade852", "Host": "mail.croatiahunt.com"}

Source: 14.2.BnevyAj.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4x nop then jmp 07790DCDh	0_2_07790930
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4x nop then jmp 07790DCDh	0_2_07790040
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4x nop then jmp 07790DCDh	0_2_07790D8D
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4x nop then jmp 07790DCDh	0_2_07790C7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4x nop then jmp 07790DCDh	0_2_07790007

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic

TCP traffic: 192.168.2.3:49805 -> 116.202.174.203:587

Source: global traffic

TCP traffic: 192.168.2.3:49805 -> 116.202.174.203:587

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://MpOtQG.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.570571523.000000000129D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.578005571.0000000006940000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	String found in binary or memory: http://croatiahunt.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.312248713.000000000193D000.00000004.00000001.sdmp	String found in binary or memory: http://en.w$
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.314720353.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com7
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	String found in binary or memory: http://mail.croatiahunt.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.578005571.0000000006940000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343797027.0000000007D70000.00000004.00020000.sdmp, BnevyAj.exe, 0000000B.00000002.431516007.0000000006DB0000.00000004.00020000.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.325282654.000000000616D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.324947932.0000000006169000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerst
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.338465801.0000000006160000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.338465801.0000000006160000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comion%
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com8
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313533747.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comn-u
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comyp
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317020564.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317571947.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316994061.000000000619D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnA
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317020564.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnj
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-cz
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/alik
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/7
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com5
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comY
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316301429.0000000006166000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krll
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316301429.0000000006166000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.krre
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.314720353.000000000617B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comF
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.578005571.0000000006940000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573089034.000000000326F000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573870566.00000000032E7000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000003.550573341.0000000001084000.00000004.00000001.sdmp	String found in binary or memory: https://vF9HSjffwxoWNFAu.org
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: mail.croatiahunt.com

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_018ED064	0_2_018ED064
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_018EF28A	0_2_018EF28A
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_018EF298	0_2_018EF298
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07D6CAF8	0_2_07D6CAF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07D66D90	0_2_07D66D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07D66DA0	0_2_07D66DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01075140	4_2_01075140
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01072D0C	4_2_01072D0C
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0107CD98	4_2_0107CD98
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01077DA0	4_2_01077DA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01070E80	4_2_01070E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0107A190	4_2_0107A190
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0107B238	4_2_0107B238
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01079C61	4_2_01079C61
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0107E660	4_2_0107E660
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012B2D50	4_2_012B2D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012BCDA8	4_2_012BCDA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012BEB00	4_2_012BEB00
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012B2768	4_2_012B2768
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012BB740	4_2_012BB740
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012B1FE0	4_2_012B1FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_013846A0	4_2_013846A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01383CF6	4_2_01383CF6
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01384630	4_2_01384630
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01384672	4_2_01384672
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_01384652	4_2_01384652
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0138DA00	4_2_0138DA00
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C5D064	11_2_00C5D064
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C5F296	11_2_00C5F296
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C5F298	11_2_00C5F298
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06DACAF8	11_2_06DACAF8
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06DA6D90	11_2_06DA6D90
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06DA6DA0	11_2_06DA6DA0
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_028246A0	14_2_028246A0
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_0282DA10	14_2_0282DA10
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_028245B0	14_2_028245B0

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll< vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameGDufUjPAGIrcCocQttaA.exe4 vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp	Binary or memory string: ol,\\StringFileInfo\\000004B0\\OriginalFilename vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000000.334522089.0000000000C34000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.569149238.0000000000DD8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameGDufUjPAGIrcCocQttaA.exe4 vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe DC07322EF1652695B5E85BFD5D6DA8C5B6C311D26FF13EB18A390CD4B7232203

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: BnevyAj.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Jump to behavior

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe 'C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

File created: C:\Users\user\AppData\Local\Gottschalks

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/4@4/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.e00000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.e00000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: BnevyAj.exe.4.dr, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.bc0000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.bc0000.1.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.2.BnevyAj.exe.1c0000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.BnevyAj.exe.1c0000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.2.BnevyAj.exe.640000.1.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.0.BnevyAj.exe.640000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07790FDB pushad ; ret	0_2_07790FD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07790F9C pushad ; ret	0_2_07790FD1
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07790F9C push eax; ret	0_2_07790FD9
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_0779366E push cs; retf	0_2_0779366F
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 0_2_07793665 push FFFFFF8Bh; iretd	0_2_07793667
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_0107C25F push eax; iretd	4_2_0107C269
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Code function: 4_2_012B7C79 push esi; retf	4_2_012B7CCA
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06DA6C4B push es; retf	11_2_06DA6C4C
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_07030F9C pushad ; ret	11_2_07030FD1
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_07030FD3 push eax; ret	11_2_07030FD9
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_07030FDB pushad ; ret	11_2_07030FD1
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_07033665 push FFFFFF8Bh; iretd	11_2_07033667
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_0703366E push cs; retf	11_2_0703366F

Source: initial sample	Static PE information: section name: .text entropy: 7.80231606159
Source: initial sample	Static PE information: section name: .text entropy: 7.80231606159

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

File created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

File opened: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 11.2.BnevyAj.exe.2591524.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.3131990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5328, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe TID: 7116	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe TID: 7096	Thread sleep count: 596 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe TID: 7096	Thread sleep count: 9253 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 6544	Thread sleep time: -40886s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3104	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 2408	Thread sleep count: 2396 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 2408	Thread sleep count: 7444 > 30	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Window / User API: threadDelayed 596	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Window / User API: threadDelayed 9253	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 2396	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 7444	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 40886	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.570305270.000000000123F000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BnevyAj.exe, 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Code function: 4_2_0107C4B8 LdrInitializeThunk,

4_2_0107C4B8

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Memory written: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Memory written: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe			Jump to behavior

Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571689711.0000000001930000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.571049871.00000000013D0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571689711.0000000001930000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.571049871.00000000013D0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571689711.0000000001930000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.571049871.00000000013D0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571689711.0000000001930000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.571049871.00000000013D0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 14.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.428bd80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37e5230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37e5230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4234960.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.36ebd80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.3694960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5476, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5476, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 14.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.428bd80.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37e5230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37e5230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4385230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.4234960.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.36ebd80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.3694960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 5476, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Registry Run Keys / Startup Folder1	Process Injection112	Masquerading1	OS Credential Dumping2	Security Software Discovery211	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Disable or Modify Tools1	Credentials in Registry1	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Information Discovery114	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
14.2.BnevyAj.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File
4.2.SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.sajatypeworks.com5	0%	Avira URL Cloud	safe
https://vF9HSjffwxoWNFAu.org	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnA	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.comF	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/7	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/-cz	0%	URL Reputation	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.comion%	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://MpOtQG.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnj	0%	URL Reputation	safe
http://www.fonts.comyp	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comY	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.krll	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://mail.croatiahunt.com	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.fonts.comn-u	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://en.w$	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/alik	0%	Avira URL Cloud	safe
http://fontfabrik.com7	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://croatiahunt.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fonts.com8	0%	URL Reputation	safe
http://www.sandoll.co.krre	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
croatiahunt.com	116.202.174.203	true	true		unknown
mail.croatiahunt.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com5	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
https://vF9HSjffwxoWNFAu.org	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573089034.000000000326F000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573870566.00000000032E7000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000003.550573341.0000000001084000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnA	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316994061.000000000619D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.325282654.000000000616D000.00000004.00000001.sdmp	false		high
http://www.tiro.comF	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.314720353.000000000617B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/7	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/-cz	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343797027.0000000007D70000.00000004.00020000.sdmp, BnevyAj.exe, 0000000B.00000002.431516007.0000000006DB0000.00000004.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comion%	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.338465801.0000000006160000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrita	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.338465801.0000000006160000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://MpOtQG.com	BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnj	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317020564.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comyp	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comY	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313070156.000000000617B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%GETMozilla/5.0	BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://www.sandoll.co.krll	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316301429.0000000006166000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designerst	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.324947932.0000000006169000.00000004.00000001.sdmp	false		high
http://mail.croatiahunt.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.578005571.0000000006940000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comn-u	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313533747.000000000617B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%$	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317571947.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://en.w$	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.312248713.000000000193D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cn	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.317020564.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/alik	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com7	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.314720353.000000000617B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/t	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://croatiahunt.com	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000004.00000002.573374281.00000000032BB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.320481194.0000000006164000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000002.343427416.0000000007372000.00000004.00000001.sdmp	false		high
http://www.fonts.com8	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.313434875.000000000617B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krre	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, 00000000.00000003.316301429.0000000006166000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.202.174.203	croatiahunt.com	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502297
Start date:	13.10.2021
Start time:	19:27:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.27244 (renamed file extension from 27244 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/4@4/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 16% Quality standard deviation: 25.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 149 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.49.157.6, 2.20.178.24, 2.20.178.33, 209.197.3.8, 93.184.221.240, 20.199.120.182, 20.199.120.151, 52.251.79.25, 20.54.110.249, 20.82.210.154, 40.112.88.60 Excluded domains from analysis (whitelisted): consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, ris.api.iris.microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/502297/sample/SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe

Simulations

Behavior and APIs

Time	Type	Description
19:28:25	API Interceptor	668x Sleep call for process: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe modified
19:28:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
19:29:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
19:29:08	API Interceptor	405x Sleep call for process: BnevyAj.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
116.202.174.203	DHL consignment number_600595460.xlsx	Get hash	malicious	Browse
116.202.174.203	Po____211110.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	FTdhc25gn8.exe	Get hash	malicious	Browse	88.99.75.82
	SecuriteInfo.com.Ransom.Stop.Z5.27157.exe	Get hash	malicious	Browse	88.99.75.82
	Ref 0180066743.xlsx	Get hash	malicious	Browse	136.243.159.53
	DHL consignment number_600595460.xlsx	Get hash	malicious	Browse	116.202.174.203
	setup_x86_x64_install.exe	Get hash	malicious	Browse	88.99.66.31
	HqiJ8HpbxU.exe	Get hash	malicious	Browse	136.243.159.53
	zrArDsoum0.exe	Get hash	malicious	Browse	88.99.75.82
	0000000588.pdf.exe	Get hash	malicious	Browse	116.203.31.151
	FAj7shxXukkNrTk.exe	Get hash	malicious	Browse	88.99.137.80
	UZWdHg3hWA.exe	Get hash	malicious	Browse	88.99.75.82
	LBJiq1QBaH.exe	Get hash	malicious	Browse	88.99.75.82
	NZi63BWERD.exe	Get hash	malicious	Browse	168.119.93.163
	3ZDXaih2Iv.exe	Get hash	malicious	Browse	5.9.250.2
	y5V9T1zkVO.exe	Get hash	malicious	Browse	136.243.159.53
	p6fx0L15Ae.exe	Get hash	malicious	Browse	168.119.93.163
	SecuriteInfo.com.PUA.Tool.Linux.BtcMine.2805.26628.5655	Get hash	malicious	Browse	88.99.193.240
	Purchase_order_21518.doc	Get hash	malicious	Browse	95.216.94.72
	Order EQE0905.xlsx	Get hash	malicious	Browse	168.119.93.163
	Contract.xlsx	Get hash	malicious	Browse	136.243.159.53
	SwiftRefINV0899211.xlsx	Get hash	malicious	Browse	136.243.159.53

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	DHL consignment number_600595460.xlsx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BnevyAj.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.348115897127242
Encrypted:	false
SSDEEP:	24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
MD5:	832D6A22CE7798D72609B9C21B4AF152
SHA1:	B086DE927BFEE6039F5555CE53C397D1E59B4CA4
SHA-256:	9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
SHA-512:	A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe.log Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.348115897127242
Encrypted:	false
SSDEEP:	24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
MD5:	832D6A22CE7798D72609B9C21B4AF152
SHA1:	B086DE927BFEE6039F5555CE53C397D1E59B4CA4
SHA-256:	9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
SHA-512:	A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	564736
Entropy (8bit):	7.0819561487133305
Encrypted:	false
SSDEEP:	6144:0MkhBXuLbabNr+o6RxQbACvuj8qLhT7uu5ziEjPY2hL1Vkebv0duOjwYB:vSBXuLbalbMebAr9LNu3KY8L1u+0j1
MD5:	A665B705B9381B33AAA9E307FE340AF7
SHA1:	A6FBA4F009921B1DE9D524047BCB7FA0E571A116
SHA-256:	DC07322EF1652695B5E85BFD5D6DA8C5B6C311D26FF13EB18A390CD4B7232203
SHA-512:	B7E7FF96DCE12935C71B6E6B6FC74652CD08725D8DE29A91E35B0D4F8F351D14F371E2D48A3AB5FE733003764AF09B6BE6DC6D943112B596FA2B09A7638BBAEE
Malicious:	true
Joe Sandbox View:	Filename: DHL consignment number_600595460.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.fa..............0..(...t......RF... ...`....@.. ....................................@..................................F..O....`..(q........................................................................... ............... ..H............text...X&... ...(.................. ..`.rsrc...(q...`...r.................@..@.reloc..............................@..B................4F......H.......Lb...O......Y...`................................................0..V.........}.......s....}......}......}.....(.......(......{....r...po......{....r...po........0.............(....&.{.........,....8....sA...%.{.....\|....(....Z.{.....\|....(....Z . &.s....} ...%.}......{ ...(.........(....o........+c...+C.....X.].......,+..(.......{....Z...{....Z.{.....{....o ........X.....\|....(..........-....X.....\|....(..........-......,...o!.....sB........\|....(.....\|....(....s"

C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.0819561487133305
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
File size:	564736
MD5:	a665b705b9381b33aaa9e307fe340af7
SHA1:	a6fba4f009921b1de9d524047bcb7fa0e571a116
SHA256:	dc07322ef1652695b5e85bfd5d6da8c5b6c311d26ff13eb18a390cd4b7232203
SHA512:	b7e7ff96dce12935c71b6e6b6fc74652cd08725d8de29a91e35b0d4f8f351d14f371e2d48a3ab5fe733003764af09b6be6dc6d943112b596fa2b09a7638bbaee
SSDEEP:	6144:0MkhBXuLbabNr+o6RxQbACvuj8qLhT7uu5ziEjPY2hL1Vkebv0duOjwYB:vSBXuLbalbMebAr9LNu3KY8L1u+0j1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.fa..............0..(...t......RF... ...`....@.. ....................................@................................

File Icon


Icon Hash:	0c529252d9cce41b

Static PE Info

General
Entrypoint:	0x464652
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61668753 [Wed Oct 13 07:14:27 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x64600	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x27128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x62658	0x62800	False	0.889331178617	data	7.80231606159	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0x27128	0x27200	False	0.141298921725	data	3.94408724321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x66220	0xe8ac	data
RT_ICON	0x74acc	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x75b74	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7811c	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7c344	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x8cb6c	0x14	data
RT_GROUP_ICON	0x8cb80	0x4c	data
RT_VERSION	0x8cbcc	0x370	data
RT_MANIFEST	0x8cf3c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Gottschalks 2011
Assembly Version	1.0.0.0
InternalName	IsolatedStorageFi.exe
FileVersion	1.0.0.0
CompanyName	Gottschalks
LegalTrademarks
Comments
ProductName	MapEditor1
ProductVersion	1.0.0.0
FileDescription	MapEditor1
OriginalFilename	IsolatedStorageFi.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 19:30:13.103229046 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:13.125179052 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:13.125416040 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.159970999 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.160794973 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.182768106 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.183624983 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.207288980 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.260672092 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.294977903 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.324507952 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.324536085 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.324553013 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.324567080 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.324662924 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.324687958 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.326714993 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.370016098 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.376245022 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.398380995 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.450635910 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.803272009 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.825608015 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.826997995 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.849235058 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.850076914 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.877826929 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.878866911 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.900772095 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.901319027 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.931308031 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.932029009 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.953816891 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.956187963 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.956437111 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.957825899 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.957959890 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:15.977981091 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.978003025 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.979522943 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.979996920 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:15.981199026 CEST	587	49805	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:16.026278973 CEST	49805	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.777714014 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.799082041 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.799212933 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.822663069 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.823153019 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.844769955 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.845032930 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.867923975 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.874967098 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.901875973 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.901902914 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.901916027 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.901928902 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.902518988 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.903554916 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.910111904 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.931709051 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.947880030 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.969444990 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.970362902 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:38.992412090 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:38.993261099 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.019107103 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.019745111 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.041667938 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.042510986 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.071536064 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.071980000 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.093463898 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.094899893 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.095077038 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.095168114 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.095177889 CEST	49807	587	192.168.2.3	116.202.174.203
Oct 13, 2021 19:30:39.116240978 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.116280079 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.116287947 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.116296053 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.117386103 CEST	587	49807	116.202.174.203	192.168.2.3
Oct 13, 2021 19:30:39.168803930 CEST	49807	587	192.168.2.3	116.202.174.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2021 19:30:12.850055933 CEST	63456	53	192.168.2.3	8.8.8.8
Oct 13, 2021 19:30:12.875040054 CEST	53	63456	8.8.8.8	192.168.2.3
Oct 13, 2021 19:30:12.927783012 CEST	58540	53	192.168.2.3	8.8.8.8
Oct 13, 2021 19:30:12.954381943 CEST	53	58540	8.8.8.8	192.168.2.3
Oct 13, 2021 19:30:38.734894037 CEST	58942	53	192.168.2.3	8.8.8.8
Oct 13, 2021 19:30:38.753648996 CEST	53	58942	8.8.8.8	192.168.2.3
Oct 13, 2021 19:30:38.756289005 CEST	64432	53	192.168.2.3	8.8.8.8
Oct 13, 2021 19:30:38.774570942 CEST	53	64432	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 13, 2021 19:30:12.850055933 CEST	192.168.2.3	8.8.8.8	0x7973	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:12.927783012 CEST	192.168.2.3	8.8.8.8	0x9dd6	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:38.734894037 CEST	192.168.2.3	8.8.8.8	0xb93d	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:38.756289005 CEST	192.168.2.3	8.8.8.8	0xdf3b	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 13, 2021 19:30:12.875040054 CEST	8.8.8.8	192.168.2.3	0x7973	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 19:30:12.875040054 CEST	8.8.8.8	192.168.2.3	0x7973	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:12.954381943 CEST	8.8.8.8	192.168.2.3	0x9dd6	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 19:30:12.954381943 CEST	8.8.8.8	192.168.2.3	0x9dd6	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:38.753648996 CEST	8.8.8.8	192.168.2.3	0xb93d	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 19:30:38.753648996 CEST	8.8.8.8	192.168.2.3	0xb93d	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)
Oct 13, 2021 19:30:38.774570942 CEST	8.8.8.8	192.168.2.3	0xdf3b	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 13, 2021 19:30:38.774570942 CEST	8.8.8.8	192.168.2.3	0xdf3b	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 13, 2021 19:30:15.159970999 CEST	587	49805	116.202.174.203	192.168.2.3	220-srv1.kuhada.com ESMTP Exim 4.94.2 #2 Wed, 13 Oct 2021 19:30:15 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 13, 2021 19:30:15.160794973 CEST	49805	587	192.168.2.3	116.202.174.203	EHLO 061544
Oct 13, 2021 19:30:15.182768106 CEST	587	49805	116.202.174.203	192.168.2.3	250-srv1.kuhada.com Hello 061544 [102.129.143.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 13, 2021 19:30:15.183624983 CEST	49805	587	192.168.2.3	116.202.174.203	STARTTLS
Oct 13, 2021 19:30:15.207288980 CEST	587	49805	116.202.174.203	192.168.2.3	220 TLS go ahead
Oct 13, 2021 19:30:38.822663069 CEST	587	49807	116.202.174.203	192.168.2.3	220-srv1.kuhada.com ESMTP Exim 4.94.2 #2 Wed, 13 Oct 2021 19:30:38 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 13, 2021 19:30:38.823153019 CEST	49807	587	192.168.2.3	116.202.174.203	EHLO 061544
Oct 13, 2021 19:30:38.844769955 CEST	587	49807	116.202.174.203	192.168.2.3	250-srv1.kuhada.com Hello 061544 [102.129.143.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 13, 2021 19:30:38.845032930 CEST	49807	587	192.168.2.3	116.202.174.203	STARTTLS
Oct 13, 2021 19:30:38.867923975 CEST	587	49807	116.202.174.203	192.168.2.3	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608 Parent PID: 3876

General

Start time:	19:28:10
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe'
Imagebase:	0xe00000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.339779218.00000000030E1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.340326707.00000000040E9000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252 Parent PID: 4608

General

Start time:	19:28:26
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe
Imagebase:	0xbc0000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.571975885.0000000002F51000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.568503526.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 5328 Parent PID: 3352

General

Start time:	19:29:02
Start date:	13/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Imagebase:	0x1c0000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.427226592.0000000002541000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.427794658.0000000003549000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 5476 Parent PID: 5328

General

Start time:	19:29:08
Start date:	13/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Imagebase:	0x640000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.571584010.0000000002981000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000E.00000002.568475564.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 7036 Parent PID: 3352

General

Start time:	19:29:11
Start date:	13/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Imagebase:	0xf20000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 4608 Parent PID: 3876 SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exeCOMMON

Executed Functions

Function 07790930, Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

., xrefs: 07790D67
&, xrefs: 07790970

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: &$.
API String ID: 0-4005498665
Opcode ID: 67e1f4ca85d37a4ac61885854b0f52021d9fd3231e3a2e23fa7142ecea2f3e1e
Instruction ID: a74e6853b806345178792315c79de09ddf18fd3bbc06a4d3c10e5c1950efdb21
Opcode Fuzzy Hash: 67e1f4ca85d37a4ac61885854b0f52021d9fd3231e3a2e23fa7142ecea2f3e1e
Instruction Fuzzy Hash: C83103B492222ACFCF24DF60D9487ECBBB5AB4A341F0085EAD449A7290C7749EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07790C7C, Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

., xrefs: 07790D67

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 4cdf68e6c6741a6319a031758fbb550c5fb0f8d9128f9a185dee45de18949ba8
Instruction ID: 9762ae35e638219ac8c7844277006ffa843cd1c609a340a25b3c94a08b9fada7
Opcode Fuzzy Hash: 4cdf68e6c6741a6319a031758fbb550c5fb0f8d9128f9a185dee45de18949ba8
Instruction Fuzzy Hash: 0D1127B5A22229CFCB20DF64D9442ECBBB4EB4A351F0055E6C44DA7251DB749A91CF14

Uniqueness

Uniqueness Score: -1.00%

Function 07D6CAF8, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c27ebf8da24837edad9f7be0ec2ea333f823296f7aeb326571bfc41324aadd4
Instruction ID: e5d3410cceac859ab80549aa54ef3e570c2e56159d7b1219b4aa9f365ed15d36
Opcode Fuzzy Hash: 2c27ebf8da24837edad9f7be0ec2ea333f823296f7aeb326571bfc41324aadd4
Instruction Fuzzy Hash: C4A103B4E102188FCB04DFE9C5486DEFBF2BB89300F289569D489A7345DB34A985CF65

Uniqueness

Uniqueness Score: -1.00%

Function 07D66D90, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188948bca948a1a27541467bab83ad260e02a17970759f9cda3aa7affa521a7a
Instruction ID: caa646e56ab3042188db5888d824a8e8fbddad328fc9b708e6a2c7e7130466f1
Opcode Fuzzy Hash: 188948bca948a1a27541467bab83ad260e02a17970759f9cda3aa7affa521a7a
Instruction Fuzzy Hash: 97619F70E002098FDB24DFB6E4456DEBBB6EF89204F04C939D104AB274DF789856DB91

Uniqueness

Uniqueness Score: -1.00%

Function 07790007, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d4680de058af1a9b4ef9cc445f9474258e84670a60ab83eebed0c7be111604
Instruction ID: 45dd53c443377a3a8863d800aa39b0cce6408a58e79d6120429047e9eb3872dd
Opcode Fuzzy Hash: 14d4680de058af1a9b4ef9cc445f9474258e84670a60ab83eebed0c7be111604
Instruction Fuzzy Hash: 8241A9B1D1521ACFCB25CF66DC007E9BBB6AF8A340F0481FAC458AB251EB745A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07790040, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799ffa665f3fa66b62ace35960ae6f1cabca2606045163ee2a8c7087a1deaede
Instruction ID: a0ddb89e99f44e0f4123cee10914ad6d208319d0feaf2c156edec98b98cc3552
Opcode Fuzzy Hash: 799ffa665f3fa66b62ace35960ae6f1cabca2606045163ee2a8c7087a1deaede
Instruction Fuzzy Hash: E24118B1D5122ACBDB24CF66D8447E9BBB6AF89340F00C5BA9518A7240EB745AC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07790D8D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3b39b87e6c482cf16c2061373a9b51fb131749e3a4933f8c7f8e06456f6518
Instruction ID: dcfce3b86aed3ff27b772759a5b2dadc7e21a150d72fdb42a8f30697dbbd0f22
Opcode Fuzzy Hash: 0f3b39b87e6c482cf16c2061373a9b51fb131749e3a4933f8c7f8e06456f6518
Instruction Fuzzy Hash: 5331D271D11219CFCB20DF64D8447E8BBB5FF9A341F1095AAE909A7240D7B0AAD4CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07D6EC98, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07D6EECE

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 26a4edb3eb37eff4e99e04c64250c30fd8878f7bb453ebcef4b11f6d3d5315ac
Instruction ID: b8e020e36bb56a5c444484b8851643fdd107dd41a1716d43f1dff94565d33c89
Opcode Fuzzy Hash: 26a4edb3eb37eff4e99e04c64250c30fd8878f7bb453ebcef4b11f6d3d5315ac
Instruction Fuzzy Hash: 129169B5D00219CFDF20CFA9C8887DEFBB2BB49314F148569E859A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 018EA2D0, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018EA516

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 982625277475f2a1f5e27cd44565fac9812060ffc4439589674d90833c6c4c39
Instruction ID: d618e2b4a8e73cae75c630f8f843253386ab7684ea688201277f5364190a7475
Opcode Fuzzy Hash: 982625277475f2a1f5e27cd44565fac9812060ffc4439589674d90833c6c4c39
Instruction Fuzzy Hash: 96712370A00B058FDB28DF6AC44879ABBF5BF89704F00892ED48AD7A50DB75E945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07D6EA10, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07D6EAA0

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 60ede36107a127145694a0a292c38aa757bdf8792f4d1ffe4904a19633c3dd65
Instruction ID: c26e4470c1d06925b4ed4515818149bac03ede4c787ec6c76aa84e6c0b4e57a4
Opcode Fuzzy Hash: 60ede36107a127145694a0a292c38aa757bdf8792f4d1ffe4904a19633c3dd65
Instruction Fuzzy Hash: F12127B59003599FCF10CFA9C9847DEBBF5FF48324F108829E959A7241D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 018EAFFC, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,018EC7BE,?,?,?,?,?), ref: 018EC87F

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64e551d8ae848e125fe2156f681da48fb2d86ea616f4fcb30c245cf6ec4bba40
Instruction ID: bef270a3a1798d3f544d139ff5ace137127d5af00d5ae5aba405801e1c7a9da6
Opcode Fuzzy Hash: 64e551d8ae848e125fe2156f681da48fb2d86ea616f4fcb30c245cf6ec4bba40
Instruction Fuzzy Hash: C92107B5D00208AFDB10CF99D988ADEBBF8EB49324F14841AE959A7310D374A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 018EC7F0, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,018EC7BE,?,?,?,?,?), ref: 018EC87F

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 09436c8abc4271a76e694460141c69215a331748449fa0a07b895a32208891d8
Instruction ID: cd9787069f35a7ca154a015d6d43b18e874efd9f4250e99c52c14a07853f0104
Opcode Fuzzy Hash: 09436c8abc4271a76e694460141c69215a331748449fa0a07b895a32208891d8
Instruction Fuzzy Hash: 802105B5D00248AFDB10CFA9D988BDEBBF8FB08324F14841AE958B7250D374A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07D6EB00, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07D6EB80

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3711bf18eb5e09522c4f64622171c70d72526d2ec5be29f1d7a8360840ade4a2
Instruction ID: 05737403493b90c0f9cd87047bb3915d103f121a72d2495a0751552ecc126bdb
Opcode Fuzzy Hash: 3711bf18eb5e09522c4f64622171c70d72526d2ec5be29f1d7a8360840ade4a2
Instruction Fuzzy Hash: 3E2128B18003599FCF10CFA9C884AEEFBF5FF48324F508829E959A7250C7389944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07D6E878, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07D6E8F6

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 82cef4f729d213026227c3da1eca338a003475dc533d6acdfa318a620416fdc2
Instruction ID: f661b9f374bdc16912d8dcba11d65e431c32bc266a07c8509e525ca36fe572c3
Opcode Fuzzy Hash: 82cef4f729d213026227c3da1eca338a003475dc533d6acdfa318a620416fdc2
Instruction Fuzzy Hash: CA2139B1D003099FDB10CFA9C4887EEFBF4AF88264F548429D459A7241DB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 018E9DA0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018EA591,00000800,00000000,00000000), ref: 018EA7A2

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b3528ad879292aac93c85b5567d8cc4ee0ed30154fdbb99849adf010a2113209
Instruction ID: dbe04e7d2306abee62fdae103c831e9a47acfd893c6929efe4aed9955f06daee
Opcode Fuzzy Hash: b3528ad879292aac93c85b5567d8cc4ee0ed30154fdbb99849adf010a2113209
Instruction Fuzzy Hash: A71159B68003089FDB14CF9AC848ADEFBF8EB49324F00842ED956B7200C374A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07D6E950, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07D6E9BE

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 726840ebd689ecf6365b7bf831413175d9779a8750ea01399f4751be38096b08
Instruction ID: f2b0349ddec902ab08289305d34436cc880bca73eaa55bb07585e51e58e7d298
Opcode Fuzzy Hash: 726840ebd689ecf6365b7bf831413175d9779a8750ea01399f4751be38096b08
Instruction Fuzzy Hash: C8113AB19002499FCF10DFA9C8487DFFBF9AF48324F14882AD555A7250D7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018EA731, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,018EA591,00000800,00000000,00000000), ref: 018EA7A2

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7458ae4a4d20d3c4980a8f86358f8930a818c051d14c6a4933d58be3f59134ef
Instruction ID: c2bccc754d679029e82030753eb8f8453ddf4a9a70f1db217ae0e68a9e79d7b3
Opcode Fuzzy Hash: 7458ae4a4d20d3c4980a8f86358f8930a818c051d14c6a4933d58be3f59134ef
Instruction Fuzzy Hash: 631144B6C003098FDB14CFA9C948BDEFBF4AB48324F14842ED959A7210C378A645CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07D6E7C8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07D6E82A

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 48c673273c56cbb1096dfa40c0b91766ece080f7e161a6dc869c73e221afdf9d
Instruction ID: ddf77e73b02cf9ea1a61dc4b8760029fe0f0c3d6f72fc104e2da8b749e9be872
Opcode Fuzzy Hash: 48c673273c56cbb1096dfa40c0b91766ece080f7e161a6dc869c73e221afdf9d
Instruction Fuzzy Hash: 0A1128B19003498BDB10DFAAC8487EFFBF9AF88324F148829D459A7240C774A944CB95

Uniqueness

Uniqueness Score: -1.00%

Function 018EA4B0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 018EA516

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9a9125029cdd04619828858e5455a02af077bbca9a61cf84b6bcd35669dfe369
Instruction ID: 7425e8ce2577d0729c211b515f4879e53b98e1377a7e410edae90aa34d8c515c
Opcode Fuzzy Hash: 9a9125029cdd04619828858e5455a02af077bbca9a61cf84b6bcd35669dfe369
Instruction Fuzzy Hash: 211102B5C006498FDB24CF9AC448ADEFBF4AB49324F14842AD969B7200C374A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077914DB, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0779153D

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 49caf16eb6c0634c5ab0b322b4bcb2658d6f5d2e08c7ab58202a810e697865ec
Instruction ID: a96b0913c755910a7b03f337e64578f93289cd7b5928853df30fef77c05ece73
Opcode Fuzzy Hash: 49caf16eb6c0634c5ab0b322b4bcb2658d6f5d2e08c7ab58202a810e697865ec
Instruction Fuzzy Hash: F31118B59003499FDB10CF99D948BDEBBF8EB48324F14841AE555A7600C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077914E0, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0779153D

Memory Dump Source

Source File: 00000000.00000002.343692429.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4ea2d6200d4ada132e02a8874fdd9ff59dc86761722021a54f98ce7af350113b
Instruction ID: 67f8530b2c0ca41c36999484a2db3d4c3f0402e6a798aef1fa9aba5634b1d616
Opcode Fuzzy Hash: 4ea2d6200d4ada132e02a8874fdd9ff59dc86761722021a54f98ce7af350113b
Instruction Fuzzy Hash: 1A11E5B59003499FDB10CF99D988BDEFBF8EB48324F14841AE959A7200C375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D318, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af224238fd9934a084ecc2df01ae90a7b0da8c83fad0afc584ae5726eb11170
Instruction ID: cfdc20b1573f61f3719d9c7e8eeb21f72597c15428c0c1b7033f8ce2f98f14ec
Opcode Fuzzy Hash: 9af224238fd9934a084ecc2df01ae90a7b0da8c83fad0afc584ae5726eb11170
Instruction Fuzzy Hash: 5A213771904240DFDF05CF94D9C4B6BBB65FB88314F24C96AE9054B366C33AD896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D5E0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79744a761dd69056d66bc84be47a54e5d8a666e365d5e048233aab04ec90ed87
Instruction ID: 7d5770813274ca03ed07d9c54a6dbe95cf466f7f0354d712d290ab507d1e4406
Opcode Fuzzy Hash: 79744a761dd69056d66bc84be47a54e5d8a666e365d5e048233aab04ec90ed87
Instruction Fuzzy Hash: B42133B1904240DFDF21DF94D9C0B67BB65FB88324F64856AE80D0B326C336D886CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339219234.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b4cfdef50ddaabd4a1516f789c6f6f805dbaaa583bbf41b89414ceb668d33
Instruction ID: c4f0ca1c985a8b90cb95b0cd594adcc0cb28a14948788013653653b29083ad9a
Opcode Fuzzy Hash: 143b4cfdef50ddaabd4a1516f789c6f6f805dbaaa583bbf41b89414ceb668d33
Instruction Fuzzy Hash: 6921F571904204DFDF11CF94D9C4B26BB65FBC8324F64C96EE8494B366C736D846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0143D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339219234.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3acdbf46126becc5298f0b6b468e3a9a72ccde1bd559a048a487a1d91422f58
Instruction ID: 98caeb3d7a5d43a030bb980efe5f9f59d70be803dedb353987b78e0b3ccdebba
Opcode Fuzzy Hash: e3acdbf46126becc5298f0b6b468e3a9a72ccde1bd559a048a487a1d91422f58
Instruction Fuzzy Hash: 1521F1B19042009FDB15CF94D9C4B16FB75FB88658F60C96AD84A4B366C336D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0143D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339219234.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb74522c2508f5959c3e0c5ed6787522eaf8986b2b60ce638935557d6a528958
Instruction ID: 61315bb6903cbbadc61f7ada399da66563306991b1b92a24c90cf312b006fa19
Opcode Fuzzy Hash: cb74522c2508f5959c3e0c5ed6787522eaf8986b2b60ce638935557d6a528958
Instruction Fuzzy Hash: EB2180755093808FDB02CF64D590716BF71EB86214F28C5EBD8498F6A7C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0142D313, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee72a3d7bcb2c32e095ca7c4de562fe0817a6440286f48a5bda7c79bb5137d3f
Instruction ID: 42143852bc3829befb1fa43303c9c39e8377415dfdb7c65ae1643ad0e41a57e0
Opcode Fuzzy Hash: ee72a3d7bcb2c32e095ca7c4de562fe0817a6440286f48a5bda7c79bb5137d3f
Instruction Fuzzy Hash: 9C21AF76804280DFDB16CF54D9C4B1ABF71FB84310F24C6AAD9054B656C33AD46ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D5DB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction ID: ab22dc135fa155bb4ab0b088e59a2ceb58e62d7aa2f7e27053f42fae2c976156
Opcode Fuzzy Hash: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction Fuzzy Hash: C3119D76904280CFDB12CF54D5C4B56BF61FB84320F2886AAD8094A76AC336D49ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0143D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339219234.000000000143D000.00000040.00000001.sdmp, Offset: 0143D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction ID: 27f7177e5f134abbb1e70c907cf71de4210364e6d58ec0488ae54fac1d3cf82c
Opcode Fuzzy Hash: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction Fuzzy Hash: BA118B75904280DFDB12CF54D5C4B16BBA1FB88224F28C6AAD8494B766C33AD45ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0142D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654340c9f4af2b2ce0bfb756901f153911ca6596e0953ebf242f4645faa07f5c
Instruction ID: 86961bfa2508a36232d16bf082daa71da7076517f7a1d93df948b215f4b883ef
Opcode Fuzzy Hash: 654340c9f4af2b2ce0bfb756901f153911ca6596e0953ebf242f4645faa07f5c
Instruction Fuzzy Hash: 7B014C718083949AEB108E99CDC47A3BBDCDF81278F04851BED044B352D33C9481C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0142D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339193470.000000000142D000.00000040.00000001.sdmp, Offset: 0142D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0c0dd0ab44d2581da55d60c9157d91625716a3ecdf1b2c2422f2eef6f9a79e
Instruction ID: 4272b91acb41bd1b87417b43694c68c9aa2a2b05e68e8b0f868bddb5857b2470
Opcode Fuzzy Hash: db0c0dd0ab44d2581da55d60c9157d91625716a3ecdf1b2c2422f2eef6f9a79e
Instruction Fuzzy Hash: E2F0C2718082949EEB118E59CCC4B63FF98EB81734F18C55BEE084B396C3799884CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 018EF298, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e3538816d13176002230afe3dfdcdc5c8e9c4db8bc1b0ea9e339679bd63d7
Instruction ID: 29437942e692fe0734c59d42798a6df5477cfa048906ba85fd3d98a3d6b0b923
Opcode Fuzzy Hash: 8a4e3538816d13176002230afe3dfdcdc5c8e9c4db8bc1b0ea9e339679bd63d7
Instruction Fuzzy Hash: D812EAF1419B468FF732CF65E9881893BA1F745328F924308D2616FAD9D7B8158ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 018ED064, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105a5187b9dc7ae36fa0da4a45363889c8fca212b6d8af9996c0a45bedde5bc7
Instruction ID: ecc3dda80dfd095ca5cf252bf0b4956bfeae03d4ce87ca1f908f22be8d9e94f9
Opcode Fuzzy Hash: 105a5187b9dc7ae36fa0da4a45363889c8fca212b6d8af9996c0a45bedde5bc7
Instruction Fuzzy Hash: 6EA14336E0061A8FCF15DFA9C8485DEBBF2FF85300B15856AE905EB225DB31EA45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 018EF28A, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.339583685.00000000018E0000.00000040.00000001.sdmp, Offset: 018E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de5d4f238afde26b5eeb680fe45871288f9aa12d3160a97ccb9f97b19b38f68
Instruction ID: 4e502c139049c94e51ba2e52b0c146fd1c52256e1765c823eab169ec61c1c881
Opcode Fuzzy Hash: 7de5d4f238afde26b5eeb680fe45871288f9aa12d3160a97ccb9f97b19b38f68
Instruction Fuzzy Hash: 90C130B14197468FFB32CF65E9881897B71FB85328F528309D1616F6D8D7B8148ACF48

Uniqueness

Uniqueness Score: -1.00%

Function 07D66DA0, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.343773276.0000000007D60000.00000040.00000001.sdmp, Offset: 07D60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b47b05ef5b04228010a4108f79da614f4bbb8ab017088c024903a26eabac9a
Instruction ID: 3f9460cf6e402cd564c07e2304e98a0fe17584d805df4871b95f908c107cffa1
Opcode Fuzzy Hash: 65b47b05ef5b04228010a4108f79da614f4bbb8ab017088c024903a26eabac9a
Instruction Fuzzy Hash: BF517C70A012098FDB64DFBAE4456DEBBB2EF89204F44C839D104EB274DF789846DB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe PID: 5252 Parent PID: 4608 SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exeCOMMON

Executed Functions

Function 012B1FE0, Relevance: 4.3, Strings: 3, Instructions: 515COMMON

Download Yara Rule

Strings

D0tl, xrefs: 012B25D1
D0tl, xrefs: 012B2444
D0tl, xrefs: 012B24D1

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: D0tl$D0tl$D0tl
API String ID: 0-3746232588
Opcode ID: b58e8be5cfb2ff4e32ae3a04c8774b77ffe1ba29d14c7e4e305eed18dcad6a27
Instruction ID: fb81d37c8b848d4d451e161467d0f3a5fa62fa6c4618d95948db90b559cf6fef
Opcode Fuzzy Hash: b58e8be5cfb2ff4e32ae3a04c8774b77ffe1ba29d14c7e4e305eed18dcad6a27
Instruction Fuzzy Hash: D5129F70A10219CFDB15DF68C894AEEBBF6AF88344F148569E906DB3A5DB30EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01383CF6, Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3df4985d843ad2368f8b5d2f5de23ea775b1db60148a598bf85cc042f7888954
Instruction ID: 548cc9f25abbc928d00cf8ec426da9c5ecb15065065deda67c6b064dc62feaa0
Opcode Fuzzy Hash: 3df4985d843ad2368f8b5d2f5de23ea775b1db60148a598bf85cc042f7888954
Instruction Fuzzy Hash: 16C18D70B007059FCB14EF69C49469EBBF5FF88208B108A2DD54ADB765DB74E8068BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0107C4B8, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0107C519

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c0013bdfe0dd7fa9da13ba722013d6aa82c9ff1b0488e6e99dacfab2ced1a7cf
Instruction ID: 227abbfdf71f10b2fd9754b47bc751b0c93bc1b69df574e50874248bcfb56f1b
Opcode Fuzzy Hash: c0013bdfe0dd7fa9da13ba722013d6aa82c9ff1b0488e6e99dacfab2ced1a7cf
Instruction Fuzzy Hash: 16517331A0030A9FDB14EFB4D958AEEB7F5FF88204F148969D5129B395DF30E8448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 012B2D50, Relevance: .9, Instructions: 913COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b4573d3ba4c1bef80354f0782f464b1e87bc990bfda3cc963e5237216ba11
Instruction ID: 83d9ce5e3cb5b938a781124f774c8e3a7e35bf7c48d1ba6c85157f6e470daef4
Opcode Fuzzy Hash: 9c9b4573d3ba4c1bef80354f0782f464b1e87bc990bfda3cc963e5237216ba11
Instruction Fuzzy Hash: 07822834A2020ADFCB15CF68C5C4AEEBBF6BF48354F158959E5099B2A1DB30ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012BCDA8, Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ccf029d43d62e09869c22fc30916d24f02d9615d9eac88c15b73ec24915838
Instruction ID: f6d31ba6c4d2e2059fbcd46e0c73ecb296514ff0c890c580f31b82625c09b6dd
Opcode Fuzzy Hash: c0ccf029d43d62e09869c22fc30916d24f02d9615d9eac88c15b73ec24915838
Instruction Fuzzy Hash: E5227030A152098FCB15EBB8C8946EEBBF6AF85308F14C4A9D405DB3A5DB35DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012BEB00, Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675571101493a4f2033973884a807da685c24cbd112c6209830fa33900551826
Instruction ID: 117a0ee590c0eabf8f85a8beb1f951efff64ac18ee0f9c54c041b8c56d82c153
Opcode Fuzzy Hash: 675571101493a4f2033973884a807da685c24cbd112c6209830fa33900551826
Instruction Fuzzy Hash: 0BF18F30A102198FCB14EFB8C8846DDBBB6BF88354F198569D515EB3A5DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012BB740, Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa45c553d9b75c9ff80a6c11fa1d03c1d9ca05c128d50817a87a7d6e93b47ca
Instruction ID: c9e34904a4901ab07c44fa670991cfa0b8417a4faafffd826b6a47c7ef88422f
Opcode Fuzzy Hash: 8aa45c553d9b75c9ff80a6c11fa1d03c1d9ca05c128d50817a87a7d6e93b47ca
Instruction Fuzzy Hash: A1D18230B002055FDB24EBB888997AFB6E7AFC8744F14C828D506AB7D4DF749C468795

Uniqueness

Uniqueness Score: -1.00%

Function 012B2768, Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fc0be32d2a9e85652953a4127cd1c94045c4395b6640ae9405024ee2c3d15a
Instruction ID: bb11b4f8ce261f699cd72228b3229483e94b51c623eeff4ec0f00803fdd5f93e
Opcode Fuzzy Hash: 53fc0be32d2a9e85652953a4127cd1c94045c4395b6640ae9405024ee2c3d15a
Instruction Fuzzy Hash: 37D11D31A2021ADFDB15CFA9C9C4AEDBBB6FF48380F158165E515AB261DB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01386940, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 013869A0
GetCurrentThread.KERNEL32 ref: 013869DD
GetCurrentProcess.KERNEL32 ref: 01386A1A
GetCurrentThreadId.KERNEL32 ref: 01386A73

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 52d45a9a32c594f6f8cef0e085ade3bf23824271956364ec6dec6a2c1c0f2f41
Instruction ID: 44fbadbabccc06ee9f4f16882430e10cfbda9a92131d990f5fafcf163f31dc63
Opcode Fuzzy Hash: 52d45a9a32c594f6f8cef0e085ade3bf23824271956364ec6dec6a2c1c0f2f41
Instruction Fuzzy Hash: 145157B09007489FEB14CFAAD649BDEBBF5EF88318F208559E409A73A0CB345944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 012BC3F9, Relevance: 2.8, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

xol, xrefs: 012BC46C
D0tl, xrefs: 012BC743

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: D0tl$xol
API String ID: 0-387962157
Opcode ID: 554b6b6387e7ae2e6f415af09c419b48ea1dc3d83affec23b032da4e3064b521
Instruction ID: eb95e8913d130ab7570ad8246966e0b01d38edc5427394955182ff27a36b6da6
Opcode Fuzzy Hash: 554b6b6387e7ae2e6f415af09c419b48ea1dc3d83affec23b032da4e3064b521
Instruction Fuzzy Hash: CFB115307142068FDB19AF78D895ABA7BA6EFC8390F054469E602CB3A5DF74DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012B1ACB, Relevance: 2.7, Strings: 2, Instructions: 224COMMON

Download Yara Rule

Strings

Xctl, xrefs: 012B1C4B
Xctl, xrefs: 012B1C41

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: Xctl$Xctl
API String ID: 0-1774723568
Opcode ID: 6a254ee04689c1e212876250540b1eefd41b992a5badf48302cd2706ef2e8293
Instruction ID: 98f79d5000157a11cb1ade6f987ecfaa6447feab2ccc821b38bad4da9f77d9f7
Opcode Fuzzy Hash: 6a254ee04689c1e212876250540b1eefd41b992a5badf48302cd2706ef2e8293
Instruction Fuzzy Hash: F181D134A20106CFDB04DF6CE4E99EABBB1BF89384B198469D606DB365DB31E811CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0107C410, Relevance: 1.7, APIs: 1, Instructions: 215libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0107C519

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 11dd236e3a277e4ed66842b3c3b875c3aa8835647249c7de5b67c320a2cb5181
Instruction ID: 53f498f0401f6ea1da9551285a43592dd373bd5d0cab3350be754ec0aa953a9d
Opcode Fuzzy Hash: 11dd236e3a277e4ed66842b3c3b875c3aa8835647249c7de5b67c320a2cb5181
Instruction Fuzzy Hash: 55712931A053459FDB11EF78C9589EE7FB5AF56218F0889ABD042DB2A2DF30D804C795

Uniqueness

Uniqueness Score: -1.00%

Function 0107D790, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0107D7D1

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f2ecfc8d64c84af759e0b4f8b2fb3384b6489cd8c49b1d8c4247b1b7dbcf9f24
Instruction ID: 9048770f2f7e0c31ad286df033485491ddbb59ca001fa09e6daed9969e2856c5
Opcode Fuzzy Hash: f2ecfc8d64c84af759e0b4f8b2fb3384b6489cd8c49b1d8c4247b1b7dbcf9f24
Instruction Fuzzy Hash: 04613C30E10209DBDB24EFF5D958BAEBBF6BF84304F108868E446A7394DB749845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0107E280, Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0107E3BF

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5d1377e6605707497de5d3cce494aa2c4375cf2d9eaed794b4f1bd51ababdd5d
Instruction ID: 9e5ba56ffac4c957f6605ff284a69a1911cca82ca0f48cde672daae142bbdc68
Opcode Fuzzy Hash: 5d1377e6605707497de5d3cce494aa2c4375cf2d9eaed794b4f1bd51ababdd5d
Instruction Fuzzy Hash: B4412471D003599FCB04CFA9C8086EEBBF9EF89210F04C5AAE548A7251DB74E845CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01385084, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013851A2

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff3be4f60698a57f3916d3d7c50d8b8fadeb30c81c02cd99e80eab93de9e86a4
Instruction ID: 1e0037ce22255bf0639efa74c3a6759819826d84367745a9b38cbc7c799263e9
Opcode Fuzzy Hash: ff3be4f60698a57f3916d3d7c50d8b8fadeb30c81c02cd99e80eab93de9e86a4
Instruction Fuzzy Hash: 5051BEB1D10309EFDF14CF9AC984ADEBBB5BF48314F64822AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01385090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013851A2

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c4f9061444b4f58869fffb18dfdea53d854f03a14cef184a3190a8b6eeff1f5d
Instruction ID: dd7feee3480924ae18e7edff76f554ad6d9e1e4f824be5d8389a495f39896a43
Opcode Fuzzy Hash: c4f9061444b4f58869fffb18dfdea53d854f03a14cef184a3190a8b6eeff1f5d
Instruction Fuzzy Hash: 8E41B0B1D10309EFDF14CF9AC984ADEBBB5BF48354F64812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01386C2A, Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01386BEF

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3e22a126f28d995f06548262caa251fd7954aef9678770875df075cea6940d1c
Instruction ID: 2cba5b8ab89f76b24617bc7648de6b343efb3c20c202246c46ee987faeb5bf81
Opcode Fuzzy Hash: 3e22a126f28d995f06548262caa251fd7954aef9678770875df075cea6940d1c
Instruction Fuzzy Hash: 7A41B0B46503489FE709DFA5EA8EBE93FA5FB48314F104629FA1987B94CB344801CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0107D6E0, Relevance: 1.6, APIs: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0107D7D1

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8dfe1aab4fbacde1d10302861235a3a70c4ab70f84b3b50c7f6e00da21aecb16
Instruction ID: eeeacedee15e29c9e4e2166c91a727425d5adb6aafda36423fdd8a5f5c06516a
Opcode Fuzzy Hash: 8dfe1aab4fbacde1d10302861235a3a70c4ab70f84b3b50c7f6e00da21aecb16
Instruction Fuzzy Hash: C541D130A05344DFDB45DBB8C454AAABBF1BF85304F1184AAE040EB292DB35D845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0138779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01387F09

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a47858ddc46df3746395842451feaf2ba48f6624fa49bbee62f7444c7847378f
Instruction ID: d59b8357d3b6273653cfbf4953852c1d87fbd9d352cb519fd7a774c704d98802
Opcode Fuzzy Hash: a47858ddc46df3746395842451feaf2ba48f6624fa49bbee62f7444c7847378f
Instruction Fuzzy Hash: B2416CB5900309DFDB14DF99C488AAAFBF9FF88318F248459E519A7321D730A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0138C189, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0138C212

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: ff7209931b72acad7b2e02152b4bb4f0c45e15740d1472649a6d6c93de2c5df3
Instruction ID: 4a63e6a580bddb2af09301ba57846bdc022525c48fe28409bc041960b8abe865
Opcode Fuzzy Hash: ff7209931b72acad7b2e02152b4bb4f0c45e15740d1472649a6d6c93de2c5df3
Instruction Fuzzy Hash: 5031EFB18043448FDB10EFA9D9497DEBFF0EB46318F14801AE449A7252C7795408CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01386B62, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01386BEF

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 703904b9301437e6fa873e6d677cd2be3a26902712f5eee4e4986395df6d910f
Instruction ID: 29f5b318be052580182f676afe869d198c7b94f504bb062fe9c5ead1fc9bdff5
Opcode Fuzzy Hash: 703904b9301437e6fa873e6d677cd2be3a26902712f5eee4e4986395df6d910f
Instruction Fuzzy Hash: 9221E6B5D00248AFDF10CF9AD985ADEBBF8EF48324F14842AE955A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01386B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01386BEF

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0aa8b5375844015b22920d50e7f8d048ff7bc34bbf98aba638df9523716159b7
Instruction ID: 6932a3c8ae7b649daae33b55f21f0b646f7475c9286e9c41688ccbcd06c54330
Opcode Fuzzy Hash: 0aa8b5375844015b22920d50e7f8d048ff7bc34bbf98aba638df9523716159b7
Instruction Fuzzy Hash: 2621E4B5D00208AFDB10CF9AD984ADEBBF8EF48324F14842AE915A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0107E350, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0107E3BF

Memory Dump Source

Source File: 00000004.00000002.569376288.0000000001070000.00000040.00000010.sdmp, Offset: 01070000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b9136e9c698883abf668462dbddc1aed1ff9efcac2a48a881f4ff1288276177a
Instruction ID: 6ebe56dbcdd44fd63676e1ccae667e4c63e1c20ff4cf7a97ec552f5d8387840b
Opcode Fuzzy Hash: b9136e9c698883abf668462dbddc1aed1ff9efcac2a48a881f4ff1288276177a
Instruction Fuzzy Hash: 1A1158B1C00219ABCB10CF9AD8487DEFBF4AF48220F04856AE458B7240D374A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 0138C198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0138C212

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: db599bd8f90400d5efd50a3598a0af4c896dd77b24d9e45d76b409f3cbd9366e
Instruction ID: 70909340790be3eb4b0ea751ef7431b92fff7ba86b6b93cc907076b239665252
Opcode Fuzzy Hash: db599bd8f90400d5efd50a3598a0af4c896dd77b24d9e45d76b409f3cbd9366e
Instruction Fuzzy Hash: 5A116AB19003098FDF20EFA9D5487DEBBF4EB49318F24842AE409B7641CB396944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013840A8, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01384116

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c2b84c48490f6b23b340d3e390873541bae81327e1bbef752146a0c8385fdf19
Instruction ID: 51e53d75cc20028103ed6f99d75180590f925adb191a8bbbb85dcc1a9860c358
Opcode Fuzzy Hash: c2b84c48490f6b23b340d3e390873541bae81327e1bbef752146a0c8385fdf19
Instruction Fuzzy Hash: F21122B29007098BDB10CF9AC4447DEFBF4EF48228F15842AD419B7610D375A546CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01383300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 01384116

Memory Dump Source

Source File: 00000004.00000002.571385789.0000000001380000.00000040.00000001.sdmp, Offset: 01380000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d152c4f62d18dfb03c55c46a5180aa6cb61acf829af7bf720176cd46caf4433d
Instruction ID: 336dfce6cf4821dbe77ae00991dd5978bb26a23a19530320c6f408d412479090
Opcode Fuzzy Hash: d152c4f62d18dfb03c55c46a5180aa6cb61acf829af7bf720176cd46caf4433d
Instruction Fuzzy Hash: 8D1123B5D003498BDB20DF9AD444BDEFBF4EF49214F10842AD919B7600D374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012BF1DF, Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

D0tl, xrefs: 012BF3EE

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: D0tl
API String ID: 0-504259687
Opcode ID: cbeeec734b7a0305e4594179ce80ef5fcec62550be0bd04d7d0ae4983cbacf36
Instruction ID: a2f0d83067d7cae0fa0e2981927cc5228e8f9ef6ca9da6cf11b64a7faedb8434
Opcode Fuzzy Hash: cbeeec734b7a0305e4594179ce80ef5fcec62550be0bd04d7d0ae4983cbacf36
Instruction Fuzzy Hash: 1D7125306153859FD706DBB8CD94AEA7BF6EF85350F0580B6E105DB292DB389C05C762

Uniqueness

Uniqueness Score: -1.00%

Function 012BBC68, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

P@m, xrefs: 012BBCEF

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: P@m
API String ID: 0-3351893070
Opcode ID: ac2a8010f220e04049de61d2b0cc8454aaf9d82348d2e0bda8708be968727adc
Instruction ID: 76d027575e4ccca1ce3d1447b3f8c56dbf3cf6d5221655ab0838f63c3fe44c07
Opcode Fuzzy Hash: ac2a8010f220e04049de61d2b0cc8454aaf9d82348d2e0bda8708be968727adc
Instruction Fuzzy Hash: 5A319C30B002068FDB25AFB8C4586EEBBF6AF88344B14886DD506EB754DF38DD458B91

Uniqueness

Uniqueness Score: -1.00%

Function 012BBC78, Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

P@m, xrefs: 012BBCEF

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: P@m
API String ID: 0-3351893070
Opcode ID: da10d890c02975c4a9c2cdda0d2f3a3c8d6804b3ab45f7f3a005b297a5fd70a0
Instruction ID: 46e8af0df300fe049c7e433608da25452c7550af643ccfbc0ba4bec1f4b31553
Opcode Fuzzy Hash: da10d890c02975c4a9c2cdda0d2f3a3c8d6804b3ab45f7f3a005b297a5fd70a0
Instruction Fuzzy Hash: 8F319031B002068FDB24AFB8C4686EEBBE6AF89344B14842DD506EB354DF34DD458B92

Uniqueness

Uniqueness Score: -1.00%

Function 012BCC88, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

$,tl, xrefs: 012BCCED

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: $,tl
API String ID: 0-806668656
Opcode ID: 0acc041d2308b71b274611111589ee3944d6f3019d58b911a40bd569438a85ac
Instruction ID: a68054456000948ba993df365c15fff22e45c0709cb98e770b954b7af2882f07
Opcode Fuzzy Hash: 0acc041d2308b71b274611111589ee3944d6f3019d58b911a40bd569438a85ac
Instruction Fuzzy Hash: CA110634A1420E8BDF14EFA9D4557DE3FF1AB89744F008469C101AB294DF755818CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 012BCC77, Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

$,tl, xrefs: 012BCCED

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: $,tl
API String ID: 0-806668656
Opcode ID: 2055f461f55a85a2a4fe77286cfea88d973705ed846b50d9b3bc42e78cd1097b
Instruction ID: b4c96d7cb90e1262bddfb979f9fca15b7740cd29737ead95a5ecb97b386bd318
Opcode Fuzzy Hash: 2055f461f55a85a2a4fe77286cfea88d973705ed846b50d9b3bc42e78cd1097b
Instruction Fuzzy Hash: 33113B3472410B9BDB11EBA8D5967EE3BB1AB45348F10845AC1016B695CF65492887E2

Uniqueness

Uniqueness Score: -1.00%

Function 012B3E28, Relevance: .8, Instructions: 820COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f71b9cf94a4432f8516f772928883d70a4f69ebbdf1b99c4478698cb1fd377
Instruction ID: 1f0deefac66cb0e539d9324d2e850011a1874263a1f922da65be44872073309b
Opcode Fuzzy Hash: 80f71b9cf94a4432f8516f772928883d70a4f69ebbdf1b99c4478698cb1fd377
Instruction Fuzzy Hash: AA724D34A0011DCFEB15EFA4C9A4BEE77BAEB95304F1084B9C60A6B3A5DB309D41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 012BD5E0, Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292888f1f5674ed74a0cfa52d94ee4b661aa389d71e05244321afb6491667ab1
Instruction ID: 9d0469c13e065f39a9a367e51a97b6c94c7b72472932017562274b1ab731e28b
Opcode Fuzzy Hash: 292888f1f5674ed74a0cfa52d94ee4b661aa389d71e05244321afb6491667ab1
Instruction Fuzzy Hash: 2E428D30A10209CFCB25DFA8C584ADDB7F2EB89358F148869E50ADB361DB75DC85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012BAB78, Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3001dba2570ca7fb45904734df6f0802c5444697963b38f297b4751d72bd00
Instruction ID: 1b14b6f6c16a771d062a08774d5365ef687714394d927541ade4119f73d45bb3
Opcode Fuzzy Hash: af3001dba2570ca7fb45904734df6f0802c5444697963b38f297b4751d72bd00
Instruction Fuzzy Hash: 0B329D34A10209CFCB15EFB8D8986EDBBB6EF89344F148869E506DB365DB349C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012B5A68, Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6966ed94f4940fb3429becbd9762b3932d7d5d4b69737c1e0ee7d6e2abf3572
Instruction ID: 94bef13452e1a14c32841496e76bb39a02951b6a9b80dcbab2dca43e357706de
Opcode Fuzzy Hash: d6966ed94f4940fb3429becbd9762b3932d7d5d4b69737c1e0ee7d6e2abf3572
Instruction Fuzzy Hash: 86E1C130A181068BCB16DF78C5C859D7BF2AF8A748F648669E510DF2A9D732E803CB55

Uniqueness

Uniqueness Score: -1.00%

Function 012BDCE8, Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9766708395187c1162e9487eeb81ea06a39ec3b75fefffa6a95888e789ad77a
Instruction ID: 20e12f2781c162af75c278dc6c4239696e5cc087d3e43fb3e13635e217676ed9
Opcode Fuzzy Hash: e9766708395187c1162e9487eeb81ea06a39ec3b75fefffa6a95888e789ad77a
Instruction Fuzzy Hash: CBE16930A20205CFCB24EBA8D498ADDBBF2EF88359F15C469E50A9B750DB75AC45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012BBF40, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230fccd31f16dfc69dba66bb6073e7dad640a7c17a426019fc348536dcb0b58d
Instruction ID: 1fc1f15c62936c1e4c7d7e9dc0bf91f5fea57d615bc09931b1c9536358dad154
Opcode Fuzzy Hash: 230fccd31f16dfc69dba66bb6073e7dad640a7c17a426019fc348536dcb0b58d
Instruction Fuzzy Hash: 6AD10470A242068FCB15DFB8C8946FEBBF6AF85340F04886AE646DB251DB34DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012B16C8, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b002b76749d68414054c41d4fbfca7ccb68470727c0004677794daf88e71b5
Instruction ID: 20e1c94c3ed0f14c4ea354c832680838982b83cb22f7a714477149cb0812433e
Opcode Fuzzy Hash: 73b002b76749d68414054c41d4fbfca7ccb68470727c0004677794daf88e71b5
Instruction Fuzzy Hash: 4AC1F2303142118FDB1A9F68E8A56EE7BE2BF89384F048469E506CB395CF74DC12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012B2C43, Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769758e4857f262218b175fa42ff6153d89cf8ce652848ca954d5332c8ec4ccf
Instruction ID: 633926d75f37871f1e520cf2b9d1951982bcaf5414b2fc1d04ae6aa0606c69cc
Opcode Fuzzy Hash: 769758e4857f262218b175fa42ff6153d89cf8ce652848ca954d5332c8ec4ccf
Instruction Fuzzy Hash: 27D12630A20609DFCB15CFA9C584ADEBBB5BF48394F158659EA15AB2A1D730FC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012B4C78, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6da344d9ed6ca41d39369153e3cf933ed3d087738cc46ece3e10aeb8978c6c
Instruction ID: 056067787053c9c7ddd72bc9d7262d4f10f8e5f2e0e91360db920eaa82e395e9
Opcode Fuzzy Hash: 0f6da344d9ed6ca41d39369153e3cf933ed3d087738cc46ece3e10aeb8978c6c
Instruction Fuzzy Hash: CDD10975A102558FCB14DF6DD5C89ADBBF6FF88350B1A84A9E506AB362CB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012BF440, Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a492ae5fa87f65bbcba2a88b2e021de7da525e9256006bc8b0657c68f0a4bd
Instruction ID: e0ee7cf2a665424169a6a19968720d680b5e4ebae0ff125f6e286366e383bbc5
Opcode Fuzzy Hash: 15a492ae5fa87f65bbcba2a88b2e021de7da525e9256006bc8b0657c68f0a4bd
Instruction Fuzzy Hash: 79A15532B101128FCB189B7CCE943EEB6A6EFC9354F148479DA19CB7A1DA30CC428791

Uniqueness

Uniqueness Score: -1.00%

Function 012B4B57, Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33083c7651773174ca03f020d6c93621dea5b1f1e89453468e8232c93f5468aa
Instruction ID: d6d45b702b57eb4317c786a4759b741d9e4ab6edbbb0f3bbdeb6213af67a3926
Opcode Fuzzy Hash: 33083c7651773174ca03f020d6c93621dea5b1f1e89453468e8232c93f5468aa
Instruction Fuzzy Hash: 3BD10571E102598FCB05DFA8C9C89DDBBF6BF88350B5A8495E516AB362CB30EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012B2D40, Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafbd2d41c7a4d187048c3d72aaceddd19dcb64e951fc60475f930ebb44edf90
Instruction ID: a980a84a4b343145a20ed71a2b1115ab6b4bc9c8382e121110ae58ad619c9101
Opcode Fuzzy Hash: cafbd2d41c7a4d187048c3d72aaceddd19dcb64e951fc60475f930ebb44edf90
Instruction Fuzzy Hash: 0AD16930A2024ADFCB15CFA9C984ADEBBF5BF49354F188559E545AB262D730FC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012B2C40, Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4621fde9be5e531b1cb174e9e1bb792614de66d5f521fb380ad108fac40a7c
Instruction ID: 71afb08b5b06fc56f33cdf264f11c7291f2b1d1de3d1f0893599645e6f69facd
Opcode Fuzzy Hash: 6b4621fde9be5e531b1cb174e9e1bb792614de66d5f521fb380ad108fac40a7c
Instruction Fuzzy Hash: F4C11630A20209DFCB25CFA9C584AEEBBF5BF48354F158959EA55AB261D730FC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012B2CEB, Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e418206fd614f01da83f501d0f30e5daf87271133626c0ed38d4da1eecd3377
Instruction ID: 8e16d66663c34332ffb5b4245d2d8527eaa9241a1b54654a859e3f40bb376f4b
Opcode Fuzzy Hash: 5e418206fd614f01da83f501d0f30e5daf87271133626c0ed38d4da1eecd3377
Instruction Fuzzy Hash: 1DB10630A2020ADFDB25CFA9C584AEEBBF6BF48354F148959E915AB261D730FD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012BF7B1, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8ad5c73c1bc94a8c7b97a9726e8efb351f48383b25d585ff7b0a5b95ef1791
Instruction ID: 78e105ea486476e8f04f3540869fea13f6b368bc9376c87f34817265ff1f286b
Opcode Fuzzy Hash: ef8ad5c73c1bc94a8c7b97a9726e8efb351f48383b25d585ff7b0a5b95ef1791
Instruction Fuzzy Hash: 5D81C3307093869FD742977CCC64AE67BF5AB86344F1580F6E548DB2A3EA28DC068752

Uniqueness

Uniqueness Score: -1.00%

Function 012BFAC0, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ad26e47199b4e3d686ca9ddede416f7c247315c1b40870d748b4253afda175
Instruction ID: 52f5033e8bf66134c100848697a682abf81555568b910db980fc6ef2e9873109
Opcode Fuzzy Hash: 51ad26e47199b4e3d686ca9ddede416f7c247315c1b40870d748b4253afda175
Instruction Fuzzy Hash: F98137347201058FCB54EF78DA989ADBBF6EF88318B1188A9E506DB375DB31EC458B50

Uniqueness

Uniqueness Score: -1.00%

Function 012BFA61, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34442e8bfe5b51b945061142ef2ce41159039cab96f6ca87f46ce0faae06a2f2
Instruction ID: 18f04a894cd47b4acc3d8fe45d2d23531c62de09d50d079c2bdb2adbd691d77f
Opcode Fuzzy Hash: 34442e8bfe5b51b945061142ef2ce41159039cab96f6ca87f46ce0faae06a2f2
Instruction Fuzzy Hash: 10816A347102058FCB54EF78D9989A9BBF6EF88318B1584A9E506CB3B6DB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012B3AC8, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f1c7486671e03be663e3752b80e0608ac6a730414656e967ac2be71c456b3c
Instruction ID: 9467055a0beb0020f55273a5cc9fdb208f811c33fd898589c986bb2ab3b23b40
Opcode Fuzzy Hash: e4f1c7486671e03be663e3752b80e0608ac6a730414656e967ac2be71c456b3c
Instruction Fuzzy Hash: 19518F353241129FDB14DF7EC8C59AABBE9FF4979070944AAE506CB266EB31DC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012BBDE9, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7feb078f17efd7735f62f65de30ae8fe648cd6a79b2b8c3d873dd405e2e3a15f
Instruction ID: 6b08bdaea6ca84a7203514a4f60ff9cb226c7583a6eee0e8a810ca14f8941453
Opcode Fuzzy Hash: 7feb078f17efd7735f62f65de30ae8fe648cd6a79b2b8c3d873dd405e2e3a15f
Instruction Fuzzy Hash: BC41C5307193418FD3468B7898A5AE67BF59F82310B1584FBE285CB6A3DA78CC06C751

Uniqueness

Uniqueness Score: -1.00%

Function 012B2618, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f0cc67a84b42383c86ced00ef92938f7a57610a85314d3b04477fed806819c
Instruction ID: 020b23f76d1556005ff485bbb6a017667dc2041a8b8943825e79b8485593dd12
Opcode Fuzzy Hash: 43f0cc67a84b42383c86ced00ef92938f7a57610a85314d3b04477fed806819c
Instruction Fuzzy Hash: 29411030A10309DFCF16DF64C884BEABBE6EF49354F04806AE9158B262C774ED49DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012B58F9, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709eafdd7b1f6c031d2d501307b9f390116e09d92a302d6e96b79e614ae705a
Instruction ID: 3fc394b0ef540e2d8b82a51e4c049c3c4b23c5791779ef2ffc25d9f6c5a15dd0
Opcode Fuzzy Hash: 8709eafdd7b1f6c031d2d501307b9f390116e09d92a302d6e96b79e614ae705a
Instruction Fuzzy Hash: 9D41C6313146458FCB169F68D8956FA3BE2EF86350B04846AE58ACB2A2DB74CC11C791

Uniqueness

Uniqueness Score: -1.00%

Function 012B38D8, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45d7c1bce505911787416fb2c3d2a937b12c87ef47433c0cb2c93c080497582
Instruction ID: 6074eb725496012aeb0306c7138d11a69b892db8be4f9f5e5a1f27720e791dfc
Opcode Fuzzy Hash: c45d7c1bce505911787416fb2c3d2a937b12c87ef47433c0cb2c93c080497582
Instruction Fuzzy Hash: C24138756206199FCB15DF28D889AAA7BB5FF88350F104069FA16CB3A1CB71ED40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012BCA88, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6725d41dba3799e54eac61fda22431a9f8f7ca92c5a178df5dff3b5cf70b975e
Instruction ID: beda5857f60178099140acc008dcd1d3c8f49c3102bc80da7648729e1e0b4c61
Opcode Fuzzy Hash: 6725d41dba3799e54eac61fda22431a9f8f7ca92c5a178df5dff3b5cf70b975e
Instruction Fuzzy Hash: 49416D30B10205DFCB04EF78D895AAE7BB5AF89344B1049A9E155DB361EB34DD12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012B14A8, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda3093724981f6a0a2b36fdc4899d5946aabb63784addcb634f868a1ed32cce
Instruction ID: 3b67e54d94afac9e55661c6296b411520e247424240db9c8025f551fa5cd192d
Opcode Fuzzy Hash: cda3093724981f6a0a2b36fdc4899d5946aabb63784addcb634f868a1ed32cce
Instruction Fuzzy Hash: F841753121420A9FCF06AF69F8A5AEE7FB6EB49344F184025FA06C7251CB75D9219B90

Uniqueness

Uniqueness Score: -1.00%

Function 012B5800, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57936b8bab7900d2a530c49ad8345ffb30feef75f4641dc16434639d775e29dc
Instruction ID: 016ad4dfb794919dd246fddd960e96514b10c168a9ded5eccbacd4a9318adf5c
Opcode Fuzzy Hash: 57936b8bab7900d2a530c49ad8345ffb30feef75f4641dc16434639d775e29dc
Instruction Fuzzy Hash: C031C131A142169FCB00DFA9D8809EEBBB8FF88350F04806AE605DB362D7759941CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 012B3D08, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b93d84d33340f53bc612b770d18d83f1f90ba8d609af1d54925f0be9efe6a03
Instruction ID: 6ee9b84a6da7a49f6d9777e7420b4c683915d2fc2001e2bb63d1062d75222cdd
Opcode Fuzzy Hash: 8b93d84d33340f53bc612b770d18d83f1f90ba8d609af1d54925f0be9efe6a03
Instruction Fuzzy Hash: D521F4303202074BDB1A962988D55FE3B9BAFC5794718807ADB02CB3A6DE24CC469382

Uniqueness

Uniqueness Score: -1.00%

Function 012BE249, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c2d9d4e785acd9ba29890b292a938202cdf6142c2ef62c6748a0a3f105d4ef
Instruction ID: 8f34c2e252fe8b81c770a6e5a98ffe8bae3920e0a0a65ae3cac507944c0f4eb7
Opcode Fuzzy Hash: 93c2d9d4e785acd9ba29890b292a938202cdf6142c2ef62c6748a0a3f105d4ef
Instruction Fuzzy Hash: B931B130B113099FC741EB79D890AEE77F6EF85344B01816AE109DB355EB349D068B91

Uniqueness

Uniqueness Score: -1.00%

Function 012B3D18, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dfe8ac6e8b119c601c82526c74dd4d3d482f5db8d7c45dab303638506e22eca
Instruction ID: 2c5ba134193ee8a10a0a5589097f5f49f5efd292b1e013473e64c53c7d967d8a
Opcode Fuzzy Hash: 2dfe8ac6e8b119c601c82526c74dd4d3d482f5db8d7c45dab303638506e22eca
Instruction Fuzzy Hash: 4721C8303202174BDB199A2985D56FE3A9BAFC5794F148039DB02CF795DE75CC429381

Uniqueness

Uniqueness Score: -1.00%

Function 012BAB19, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08656b2892cd336afa640e4527492de66cfd10aa244b3e91e9f156b0f16a2490
Instruction ID: c726b36402bfd1085685d4649dbb0cc3bf37cdf8f9cbd0411b33df83096b3f69
Opcode Fuzzy Hash: 08656b2892cd336afa640e4527492de66cfd10aa244b3e91e9f156b0f16a2490
Instruction Fuzzy Hash: 51318D30A153099FCB45DFA8D984AEEBBF2FB88354F14847AE504DB252E7349D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012B3C10, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ea9be8e7443ad66351959fbcc5680872a45c787768bd2c68c501eb9fad3c0a
Instruction ID: 9a4aacc672a98e452fcfd5fff9e0ba522da9eec8832e6a60a39437c4e40090b2
Opcode Fuzzy Hash: 04ea9be8e7443ad66351959fbcc5680872a45c787768bd2c68c501eb9fad3c0a
Instruction Fuzzy Hash: 3921A37172415A8FDB11CEABD8D46FB7BEABB45380F058426EA12C7344DB71D905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0130D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571034937.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d411515858f8f7ac999842f2a2fdb5fe6c7016897fd81ffe9c7c51b4433632e
Instruction ID: 21f4b2bd45a7067c9e54ac58489a16b46215ebd9559c904ea63f4599f6da66e4
Opcode Fuzzy Hash: 1d411515858f8f7ac999842f2a2fdb5fe6c7016897fd81ffe9c7c51b4433632e
Instruction Fuzzy Hash: 9521F1B1504248DFDF06DFD4D9D0B66BFE9FB8432CF248969E8054B286C336D856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130D450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571034937.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403f93d5af3ef2774268487183b4edc321a187f1c542b1b246c7631c6980ba8c
Instruction ID: 60ce441c43497fc1050bae579397cb349f17f2a0e1505d6e6b457c436398dc47
Opcode Fuzzy Hash: 403f93d5af3ef2774268487183b4edc321a187f1c542b1b246c7631c6980ba8c
Instruction Fuzzy Hash: 89212171504204DFDF12DF94D9C0BA7BFE9FB88328F208568E8051A286C736E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0131D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571095514.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08365277d15e41274b20f27bb82e758877695d4a260ba4d2fc1f7d12dde5dec2
Instruction ID: 819f7a0292dea3e53f37187d8826fc6e6717d3130c43823c2fc9e7e41d356238
Opcode Fuzzy Hash: 08365277d15e41274b20f27bb82e758877695d4a260ba4d2fc1f7d12dde5dec2
Instruction Fuzzy Hash: AF212275504204DFDB19CF98D9C8B26BB69FB85358F20C96DD80A4B64AC33BD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 012B19F0, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726ab85fe466f821a6095ab24eafb2cdf12714b034e9dcd992269b9218a1e330
Instruction ID: 0819d5f804363073db3779738faaabcfb868daf0e040a8a7eb26618759a11369
Opcode Fuzzy Hash: 726ab85fe466f821a6095ab24eafb2cdf12714b034e9dcd992269b9218a1e330
Instruction Fuzzy Hash: 1911E5313116128BD7195A2DE4E44BEB7E6EFC87A17154069E606CB360CF20EC02CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0130D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571034937.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction ID: 45f42f4210c77490f1a4280859948fedb901c9674b67fee2a0f537828e46123f
Opcode Fuzzy Hash: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction Fuzzy Hash: E711E176404280CFCB06CF84D9C0B16BFB2FB84328F2886A9D8094B256C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130D44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571034937.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction ID: 075c30f79d0ecd6f25cedfd8a1bc92c8607a9a7ca8f2e65fdb31a84e8f003c47
Opcode Fuzzy Hash: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction Fuzzy Hash: AC11AF76404280CFDB12CF54D5C4B16BFB1FB84328F2486A9DC050B657C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012B5851, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563e9fc96cc5c4a951e5268004878aabd7973444619d965c2accf3980225d5e1
Instruction ID: d4e23ed3d1234e9d81a1906696319741c3ac8c6d5f7d0a53fcb79fb579a1a756
Opcode Fuzzy Hash: 563e9fc96cc5c4a951e5268004878aabd7973444619d965c2accf3980225d5e1
Instruction Fuzzy Hash: 76116A70E0525A9FCB01DFA9D8819EEBBF8FF88350F00842AE515E7251D7B48A51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0131D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.571095514.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction ID: 9628ee53bd0116c5db1a8db42c0017438951a07cd995d0c52084406d72311a69
Opcode Fuzzy Hash: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction Fuzzy Hash: F311BE75504280CFDB16CF54D5C4B15BB61FB85318F24C6A9D8094B65AC33BD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012BF9A0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7ff39617418ed0c17d54b9334f038c4aece42d86facea3870703c97f3f82a7
Instruction ID: 4be2ad7640a118acdf9e8a53f58513f076b1374fe449759cf9ec37383348c3bf
Opcode Fuzzy Hash: ee7ff39617418ed0c17d54b9334f038c4aece42d86facea3870703c97f3f82a7
Instruction Fuzzy Hash: E6115E34B102198FCB44EBBDD8949EEB7F6FB892547008429D109E7754EB309D028B94

Uniqueness

Uniqueness Score: -1.00%

Function 012BE188, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d7c1220bf35273da987ffaaf5081d8dfb6fe668cfba99494ebd1583a9d7dbf
Instruction ID: 880ef748cbb3c7b066b778f7245a6cb31fbaf8669f87fcc451c75f76e589b22d
Opcode Fuzzy Hash: 30d7c1220bf35273da987ffaaf5081d8dfb6fe668cfba99494ebd1583a9d7dbf
Instruction Fuzzy Hash: 25115E30B102198FCB40EBBDD8949EEB7F6FB892947508429D109E7354EB309D068B95

Uniqueness

Uniqueness Score: -1.00%

Function 012BD490, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d20e37c67f6b150bc191292c376a6c5e1b324438c404caa47963e927357bef
Instruction ID: 5a09f56284343bd6eb2f39b74206d7c3031e58a2462b73c8db84fdb616c0e90b
Opcode Fuzzy Hash: c4d20e37c67f6b150bc191292c376a6c5e1b324438c404caa47963e927357bef
Instruction Fuzzy Hash: 2D115E30B202198FCB40EFADD4959EEB7F6BB892547108429D509E3354EF34A8018B95

Uniqueness

Uniqueness Score: -1.00%

Function 012BE2A8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690d6bc54d6601752c8e5924786ea39408f72ddaa348bf3d525a6c30130af44b
Instruction ID: cfe8cfc033d488e70ccf8a48190f79aea22815d47448ca80014401cb1bcb4969
Opcode Fuzzy Hash: 690d6bc54d6601752c8e5924786ea39408f72ddaa348bf3d525a6c30130af44b
Instruction Fuzzy Hash: 27115E70B102198FCB41EFBDD8949EEB7F6FB89294B408429D109E7354EF309D028B95

Uniqueness

Uniqueness Score: -1.00%

Function 012BCBD0, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0141c7fc3d691f086e041a9e87d68897e59be7d58443cdb6476bb01cc485aefb
Instruction ID: 08487f776aee0c04db91eb7a84623d0ae1910e8f14d4622417d4785ce7e0985e
Opcode Fuzzy Hash: 0141c7fc3d691f086e041a9e87d68897e59be7d58443cdb6476bb01cc485aefb
Instruction Fuzzy Hash: 8F118BB5E20211CFC794EF78D9899AA77F5EF4821171145BAE84AD7320EB30DE118B91

Uniqueness

Uniqueness Score: -1.00%

Function 012B1628, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4719ba78b1527c654a799f8897242bf835405498479b6bd67238f31aee29fc
Instruction ID: fdda38b1ab3c7aedcf92c52ff1efb9ad64ba6e37f378a79cea656631d6b21dd7
Opcode Fuzzy Hash: 8a4719ba78b1527c654a799f8897242bf835405498479b6bd67238f31aee29fc
Instruction Fuzzy Hash: 5B01D832B141156FDB069F68A8516FE3FE6EBC8390B18801AFA05D7290DA748C219B91

Uniqueness

Uniqueness Score: -1.00%

Function 012B15E8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d7ee60ab7d3f8a413ce1c7054a76bff691a97d7df2bef4137a272bb6a7675c
Instruction ID: bfaaec24474784e9afbea6241335443a9ce1aa0966d0c2b8fcbe21418178e364
Opcode Fuzzy Hash: 88d7ee60ab7d3f8a413ce1c7054a76bff691a97d7df2bef4137a272bb6a7675c
Instruction Fuzzy Hash: EBF024327241450F8B171E5C78B05FA3B9ECBC16E0B0C0067FB0ACB213DA62C92283E5

Uniqueness

Uniqueness Score: -1.00%

Function 012BCB48, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2e84328fe192d2ecfb4aa59314abe1d54738c4fd122d1aabb8fe842c755c97
Instruction ID: 97e45b352ac915c358d663d36f2ab2a554cebe05255192b6492c089a4b61fb19
Opcode Fuzzy Hash: 2d2e84328fe192d2ecfb4aa59314abe1d54738c4fd122d1aabb8fe842c755c97
Instruction Fuzzy Hash: 2601F671E10219DFCF44EFB9D8416EEBBF5AF88240F00856AD519F7250EB749A118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 012BAAA1, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8947e1880bf29599acbeeb9f69928997c99094b1189a706f1b8701e32ae648
Instruction ID: 7bca6306df8f66578434d489f87f3eef5a61ab9ed4c57cba0de01b72b5791343
Opcode Fuzzy Hash: fd8947e1880bf29599acbeeb9f69928997c99094b1189a706f1b8701e32ae648
Instruction Fuzzy Hash: 96E0E572E101185F8750DAAC98465EF7EFDEB88360B080135E91EE3200F6748A118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 012BE1E7, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06b0264282e6d4836829daf2131450c0d16f5594ab701341f03707597435e7b
Instruction ID: f9489722cd62cb7210f6f4ba8b89904ae4545c8f90084af2b2b54c98c213ed04
Opcode Fuzzy Hash: e06b0264282e6d4836829daf2131450c0d16f5594ab701341f03707597435e7b
Instruction Fuzzy Hash: EFE06D35B101298FCF00FBF8D4949ECB3F2AFC82597008065D106E7354DE349C028B65

Uniqueness

Uniqueness Score: -1.00%

Function 012BF9FF, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1fd4e0dd1060a51b10954465979f30cac0e5866da231d2030516cbd850402e
Instruction ID: 68b64bcadc6e8e82dfbfaa1b30c95cde355150ee399cf6c4e20b8b9ee6b50e09
Opcode Fuzzy Hash: 2a1fd4e0dd1060a51b10954465979f30cac0e5866da231d2030516cbd850402e
Instruction Fuzzy Hash: C2E0ED35B10119CBCF44FBBCD4949ECB7E2BFC92597044065D50AE7754DE349C028B55

Uniqueness

Uniqueness Score: -1.00%

Function 012BD4F0, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e19f446525aa40fae37c4d53ac9e655b8b7baa1deaff92baae10b249511ebfa
Instruction ID: 4bb3c028b6b3ad38b70e1356b26baf1e679e976a041484d44e05c8ad20c65a58
Opcode Fuzzy Hash: 3e19f446525aa40fae37c4d53ac9e655b8b7baa1deaff92baae10b249511ebfa
Instruction Fuzzy Hash: 2FE0C935B6021A8BCF10EBA8E4959ECB7F2ABC9259B048065D506E7354DE3498018B55

Uniqueness

Uniqueness Score: -1.00%

Function 012BE307, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1c0ca47b1332c48b705ba594ed31f12c5aed5a5359d8b84e1cd1ea75b4bfff
Instruction ID: 916d0704eb7ed87488a78abf1d5c533e62f818259f03baa7feeb777b8cec7ff4
Opcode Fuzzy Hash: 6f1c0ca47b1332c48b705ba594ed31f12c5aed5a5359d8b84e1cd1ea75b4bfff
Instruction Fuzzy Hash: 6DE0ED35B1011A8BCF05FBBCD4959ECB7E2BFC9259B048065D50AE7354DE349C028755

Uniqueness

Uniqueness Score: -1.00%

Function 012BAAB0, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487707f5c34e9e67c28a1f096f2ad47045fb187a3e568289d4d6207b22202807
Instruction ID: 633301e8695fac7899640d1ab7dca6f8acef2bafa0c36d79056a1d11eb052df2
Opcode Fuzzy Hash: 487707f5c34e9e67c28a1f096f2ad47045fb187a3e568289d4d6207b22202807
Instruction Fuzzy Hash: 3AE01A72E102199F8B50ABADA8455AE7BF9EA88261B044576E51AE3200EA704A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 012B1D73, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3f105cae6119701efdd05103f696f03d8b5087440421659b4fc538ace95efd
Instruction ID: 1dc947fb2cf493db2a7086de287489624e5830bc20a7c06489c2fc101f1e8a07
Opcode Fuzzy Hash: 9e3f105cae6119701efdd05103f696f03d8b5087440421659b4fc538ace95efd
Instruction Fuzzy Hash: EAD0A93500830802CA19BFA4EEA37C632AAD780008B048D26A00589B78CFB8A5494A48

Uniqueness

Uniqueness Score: -1.00%

Function 012B1D80, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c792dc89e1a5f0da1300448e57515cb8ea37bcb00e3bc2d232d7200bb8ef4e
Instruction ID: afdf3c0f5bae0b4b28c99eb7ae3285779c08553a85d7e163a63a787b7671ef0d
Opcode Fuzzy Hash: b7c792dc89e1a5f0da1300448e57515cb8ea37bcb00e3bc2d232d7200bb8ef4e
Instruction Fuzzy Hash: FCC0123001C30D4ACE44BFA4E9654D733AE968110C340CD25A1054967CDFB069494F85

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 012B1F60, Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

ol, xrefs: 012B1F92
ol, xrefs: 012B1F76
ol, xrefs: 012B1F9E
ol, xrefs: 012B1F6C

Memory Dump Source

Source File: 00000004.00000002.570714901.00000000012B0000.00000040.00000010.sdmp, Offset: 012B0000, based on PE: false

Similarity

API ID:
String ID: ol$ol$ol$ol
API String ID: 0-3598129632
Opcode ID: efcc0516ca5c153a8eea874d2dabf921d435db5dd87e19fe3b52217628430e77
Instruction ID: 284b554d0bca76c8a43714970e6b8a87c934204d402aababd154f9a44744c7ae
Opcode Fuzzy Hash: efcc0516ca5c153a8eea874d2dabf921d435db5dd87e19fe3b52217628430e77
Instruction Fuzzy Hash: 3F01D4317306028F97108E6ED4A19AA77EABFBA7A03154179F611CB3B0DB70DC51C782

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BnevyAj.exe PID: 5328 Parent PID: 3352 BnevyAj.exeCOMMON

Executed Functions

Function 06DAEC98, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06DAEECE

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e52585ac372d24e48145322e82f9697b70eba18401fb837bff17d6d86c9e6eb
Instruction ID: 7679dcb611fbcb780f5011a6a9eed7781f56477a93b199c4221477b2ca2b1570
Opcode Fuzzy Hash: 1e52585ac372d24e48145322e82f9697b70eba18401fb837bff17d6d86c9e6eb
Instruction Fuzzy Hash: 9E915A71D04319CFDF60CFA8C8847DDBBB2EB88314F048569D819A7290DB749A85DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A2D0, Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C5A516

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 98877ed833aee9d9bdbbfd046512997371193ac9cf8f6e367ff6a11543e4c8c3
Instruction ID: d892e83287c635728bc6bde7b8d9e8d94a58018d4917d60178c530cd9bf51dca
Opcode Fuzzy Hash: 98877ed833aee9d9bdbbfd046512997371193ac9cf8f6e367ff6a11543e4c8c3
Instruction Fuzzy Hash: A6715674A00B048FDB24CF6AC04579ABBF1FF88304F008A2DD89AD7A50D774E9898B95

Uniqueness

Uniqueness Score: -1.00%

Function 06DAEA10, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06DAEAA0

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2b0a30bccbb8d0aaa22c3b0e58747e2e81dbe3910cb686d9fda4b009a0a5969f
Instruction ID: 577c28aaf8fbfebde754630127f2d08a25c00b8f10e4425466bd9dc048b6ff58
Opcode Fuzzy Hash: 2b0a30bccbb8d0aaa22c3b0e58747e2e81dbe3910cb686d9fda4b009a0a5969f
Instruction Fuzzy Hash: E22127719003499FCF10CFA9C984BEEBBF5FF48314F108829E919A7241D7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C5C7F0, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C5C7BE,?,?,?,?,?), ref: 00C5C87F

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 54dbbf4eef1bff3a38c39b6a7ba49592b9e233c6c77946f61912227a9dafeb81
Instruction ID: 6096b33c63ff4d49572eb72138da8a0b280cb71b8479608c4332af20e6e46341
Opcode Fuzzy Hash: 54dbbf4eef1bff3a38c39b6a7ba49592b9e233c6c77946f61912227a9dafeb81
Instruction Fuzzy Hash: 142119B5D01208AFDB10CFA9D984ADEFBF4FB48320F14841AE919A7350C774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C5AFFC, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C5C7BE,?,?,?,?,?), ref: 00C5C87F

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 696cca023f4f09bfdcd33731e721a9917ae16daf276701eb563d08949f5c65f6
Instruction ID: 361563a9d1a57622f58b4821e4c5619414fb060616af87d69dab832117290930
Opcode Fuzzy Hash: 696cca023f4f09bfdcd33731e721a9917ae16daf276701eb563d08949f5c65f6
Instruction Fuzzy Hash: 6821E5B5D00308AFDB10CF99D984ADEBBF8EB58324F14842AE919A7350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DAEB00, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06DAEB80

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1922c4b5313f5b2c7e89bc0066cd9a95facdafeb26d509008c800157e6865ba9
Instruction ID: 952dfaee3e1df02da9c6823460b81e858fa41ec66498b6f38fc1e32715bdc0a4
Opcode Fuzzy Hash: 1922c4b5313f5b2c7e89bc0066cd9a95facdafeb26d509008c800157e6865ba9
Instruction Fuzzy Hash: 892125B1C003499FCF10CFA9C984AEEBBF5FF48324F50882AE519A7250C7389944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DAE878, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06DAE8F6

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: b9e378527b34bba10b2bf18473650fa85c561dca70098b0ab28c2697d8d2f9cd
Instruction ID: ad9d0a760e6309a0d2b5fd4ffb1f1365b3f63697bebb55872d54d5a6d9c92f94
Opcode Fuzzy Hash: b9e378527b34bba10b2bf18473650fa85c561dca70098b0ab28c2697d8d2f9cd
Instruction Fuzzy Hash: DB214771D003089FDB50CFAAC9847EEBBF4EF88364F54842AD419A7241CB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C59DA0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C5A591,00000800,00000000,00000000), ref: 00C5A7A2

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5e6c92a7aedf3a88359e8173fafca617b6f3b2f63e7c5a1e6210d48b757bd998
Instruction ID: 6b5562bac9f0f1b2079271fe8413744c47e7a649b9c219b5a5dfa765e7e49050
Opcode Fuzzy Hash: 5e6c92a7aedf3a88359e8173fafca617b6f3b2f63e7c5a1e6210d48b757bd998
Instruction Fuzzy Hash: 2C1129B59002099FDB10CF9AC544BDEFBF4EB58354F14852ED915A7200C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A731, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C5A591,00000800,00000000,00000000), ref: 00C5A7A2

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 80fd00066046db2a1694cdb6853ac3425ed2f1f24ec02961153de4b33b18d8a3
Instruction ID: 285bfb1b48cbb633f156bbce7420230c65069d6ff88f6bcb4efd10a8be6a4f74
Opcode Fuzzy Hash: 80fd00066046db2a1694cdb6853ac3425ed2f1f24ec02961153de4b33b18d8a3
Instruction Fuzzy Hash: 1E1147B68002499FDB14CF9AC544BDEFBF4EB48350F14852ED815A7200C374A645CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DAE950, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06DAE9BE

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a70719172d5f83853f329334bef6d2dd0e95ab7a398c20f23a4020e1049085cc
Instruction ID: 99d2fcf2ca7d849b081d1bcd24988d5c030980268756c3fa94dc70945e2ef22f
Opcode Fuzzy Hash: a70719172d5f83853f329334bef6d2dd0e95ab7a398c20f23a4020e1049085cc
Instruction Fuzzy Hash: 5A1126719003489FCF10DFA9C9446EFBBF9AF88324F148829E519A7250C7799944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07031F9C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,07032751,?,?), ref: 070328F8

Memory Dump Source

Source File: 0000000B.00000002.431759447.0000000007030000.00000040.00000001.sdmp, Offset: 07030000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cf3c2790227f878f983d7c65947ee2c907076919271d1fc18e7429f70c57f4c9
Instruction ID: d2ba70ded5c4552aed5036b9380dc0e2444e74314e7332455f6b09c14360ebf9
Opcode Fuzzy Hash: cf3c2790227f878f983d7c65947ee2c907076919271d1fc18e7429f70c57f4c9
Instruction Fuzzy Hash: C11166B18007499FDB10CF99C548BEEBBF8EF48320F10842AD559A7340C738A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07032898, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,07032751,?,?), ref: 070328F8

Memory Dump Source

Source File: 0000000B.00000002.431759447.0000000007030000.00000040.00000001.sdmp, Offset: 07030000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3e5f5a0f547c0e671c518ab7b9f695a624332d1217950a3a9051dfd38d054ed4
Instruction ID: fac2059a9cc9bddeb9ac85e4ecc425792b07be4d842350e25552acb79c94180b
Opcode Fuzzy Hash: 3e5f5a0f547c0e671c518ab7b9f695a624332d1217950a3a9051dfd38d054ed4
Instruction Fuzzy Hash: 5E1188B5800309AFDB10CF99DA48BDEBBF8EF48324F10842AD559A3740C738A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DAE7C8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06DAE82A

Memory Dump Source

Source File: 0000000B.00000002.431406667.0000000006DA0000.00000040.00000001.sdmp, Offset: 06DA0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dd1c0434c7900052a9b4794f3edafc8ffd285b7db711459979ba571b901d3752
Instruction ID: 9bd506cbd507a8bc605064f5e30307b15381a5b63c8b52045302dedae470506c
Opcode Fuzzy Hash: dd1c0434c7900052a9b4794f3edafc8ffd285b7db711459979ba571b901d3752
Instruction Fuzzy Hash: 751128B1D003488BCB10DFAAC9447EFFBF9AF88224F148829D419A7240C778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A4B0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C5A516

Memory Dump Source

Source File: 0000000B.00000002.426980830.0000000000C50000.00000040.00000001.sdmp, Offset: 00C50000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6a2409cdf77f9bc2e55b0d6593ada51abfcf091f4eb4bfd80f9e9b4f7c7128a5
Instruction ID: b394831218bb94d75014109dc116567bfa7fc442993b7f56689dba0996e867e5
Opcode Fuzzy Hash: 6a2409cdf77f9bc2e55b0d6593ada51abfcf091f4eb4bfd80f9e9b4f7c7128a5
Instruction Fuzzy Hash: 601102B5C006498FCB10CF9AC944ADEFBF4EF48324F14852AD829A7200D378A685CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 070314DB, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0703153D

Memory Dump Source

Source File: 0000000B.00000002.431759447.0000000007030000.00000040.00000001.sdmp, Offset: 07030000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0482ab47740a138b74ae438198caf4d609c660bb5c5728ca6650f91db8f69939
Instruction ID: 60530706081ffb7085a59b84467bcf3f284e98e8c75a6617b79e650bde89792c
Opcode Fuzzy Hash: 0482ab47740a138b74ae438198caf4d609c660bb5c5728ca6650f91db8f69939
Instruction Fuzzy Hash: DC1115B5800749DFDB10CF99D984BDEBBF8EB48324F14841AE519A7240C374A644CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 070314E0, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0703153D

Memory Dump Source

Source File: 0000000B.00000002.431759447.0000000007030000.00000040.00000001.sdmp, Offset: 07030000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 95b315065df4f0b8e3b43ead949785183fdf5ca66b74559bd6993c71e42b2d57
Instruction ID: 4088651593ff310357a09d2f331c1868deedcd68b39f1d7660e41238af85c2f0
Opcode Fuzzy Hash: 95b315065df4f0b8e3b43ead949785183fdf5ca66b74559bd6993c71e42b2d57
Instruction Fuzzy Hash: 6E11E5B5800749DFDB10CF99D984BDEFBF8EB48324F14851AD559A7240C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D4F4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f1c294382c6e85e065ce0b2ca6dfbf1a639c91c9fdf63170bf68cde07803aa
Instruction ID: a94d66217a44d3a6eb9fec592c2bdf5005273913fcec814d2e5de1f6d8e14b62
Opcode Fuzzy Hash: e5f1c294382c6e85e065ce0b2ca6dfbf1a639c91c9fdf63170bf68cde07803aa
Instruction Fuzzy Hash: 79210671504244DFDF10CF94D9C0B66BFA5FB98328F2489A9EC054A2C6C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D5E0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3862b35b37064175a5fb0fd55c197c0c3760d89be91e218d8f7b4c6c3048947
Instruction ID: a3cd94445abe8fa6a4237fcbffc5a2db9da5c53d52ee46d99e7430ebd5170432
Opcode Fuzzy Hash: e3862b35b37064175a5fb0fd55c197c0c3760d89be91e218d8f7b4c6c3048947
Instruction Fuzzy Hash: 0B2128B1504244DFDF10DF90D9C0B56BFA5FB98324F2486A9E8090B2C6C337D845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426821584.0000000000B1D000.00000040.00000001.sdmp, Offset: 00B1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82729691d2738d9c17082f5ac63c19782aa443b37fd2eb8d612bddc1466fb30
Instruction ID: 32127b0e8b25c406703a972935e7896315f2b84039801e20c2adb600f0d51939
Opcode Fuzzy Hash: e82729691d2738d9c17082f5ac63c19782aa443b37fd2eb8d612bddc1466fb30
Instruction Fuzzy Hash: 8121F571504244EFDF01CF54D5C4BA6BBE5FB84314F64CAADD8095B256C336D886CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426821584.0000000000B1D000.00000040.00000001.sdmp, Offset: 00B1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3613058546387164f71f2dfbce84288e3f6494ccb655e620f70e92a32bbc6d9d
Instruction ID: 7398d3df9c576257f8ec7cacd2fc54145bb8e9d4c16dd492f414c0551798002f
Opcode Fuzzy Hash: 3613058546387164f71f2dfbce84288e3f6494ccb655e620f70e92a32bbc6d9d
Instruction Fuzzy Hash: 4C210475504244DFDB14CF14D9D8BA6BBA5FB88314F64C9ADD80A4B246C33BD887CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426821584.0000000000B1D000.00000040.00000001.sdmp, Offset: 00B1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc34e36f5abf3a0da8a57f49a6f6756127bb8a710ac9ff5c52a3e22c9f807eec
Instruction ID: 04510e75ca8d9b91e6b8a5a3872eec69e0161a31a7bfad8adb3996fbd6860ca6
Opcode Fuzzy Hash: fc34e36f5abf3a0da8a57f49a6f6756127bb8a710ac9ff5c52a3e22c9f807eec
Instruction Fuzzy Hash: A82162755087809FDB02CF14D994B51BFB1EB4A314F28C5EAD8458F297C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D4EF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction ID: 68d90c300806ca94fd10dfdb4b8aae6a0f6d42d8abff100db458c4b9a7f7a045
Opcode Fuzzy Hash: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction Fuzzy Hash: 2F11B176404280CFCB11CF54D9C4B16BFB1FB98324F2886A9DC050B696C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D5DB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction ID: 9eb9c71c985c8c14aceaead67bf264fa80cafafea72c5dc62456d19592423ad2
Opcode Fuzzy Hash: d61dc1787d2e40bcc3bc80781d9ce7e3675fb42988ff872e81e6b89b770b6d0c
Instruction Fuzzy Hash: 9C11B176504280DFCF11CF50D5C4B16BFB1FB84320F24C6A9D8090B696C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426821584.0000000000B1D000.00000040.00000001.sdmp, Offset: 00B1D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction ID: a22bf213efe6977535a41a9cf5491d33e4bd492c91afd9921c61fd01462b6f03
Opcode Fuzzy Hash: f3fa16786687011bd9a08694fe3083e0fc998bddbe896881cb926f4c2f024f48
Instruction Fuzzy Hash: BB118B75504280DFDB11CF14D5C4B55BBA1FB84324F28C6A9D8494B656C33AD88ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e930188db873621b4cc5220e84f4bc0c10063ae047ced48f065e4524121b56
Instruction ID: dc644a2f7171e945d0bab87e770fbd18be61f309cf981d274e240c54bf6b138b
Opcode Fuzzy Hash: 13e930188db873621b4cc5220e84f4bc0c10063ae047ced48f065e4524121b56
Instruction Fuzzy Hash: 5501D4714042449AEB208E99CDC4BA6BFDCEB45368F18899AE9045A2C2D7799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.426768702.0000000000B0D000.00000040.00000001.sdmp, Offset: 00B0D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec5ee5f5e22d9a2930bc1219e51c72257fe180de89808a41869c0b7358b5b66
Instruction ID: 452b598c226863320919118fc3637d7e7e538b04c112accde49664412fc9538c
Opcode Fuzzy Hash: cec5ee5f5e22d9a2930bc1219e51c72257fe180de89808a41869c0b7358b5b66
Instruction Fuzzy Hash: 21F06271404284AEE7108F59DCC4B62FFD8EB95774F18C59AED085B2C6D3799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BnevyAj.exe PID: 5476 Parent PID: 5328 BnevyAj.exeCOMMON

Executed Functions

Function 02823567, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 028251A2

Strings

5[fa, xrefs: 028250BE
5[fa, xrefs: 028250DE

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 5[fa$5[fa
API String ID: 716092398-996279914
Opcode ID: ccae944af4e7e4da13baf978fa2f9a0dc67ca50b81e51d80978ae9ccbba7c3ee
Instruction ID: abc642ec158fa3e941fb2a05b50f0e78150fd3ee42b83e3e256f08526c0e98c4
Opcode Fuzzy Hash: ccae944af4e7e4da13baf978fa2f9a0dc67ca50b81e51d80978ae9ccbba7c3ee
Instruction Fuzzy Hash: F85100B5D10319AFDF14CF99C884ADEBBB5FF48354F64812AE819AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02825084, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 028251A2

Strings

5[fa, xrefs: 028250BE
5[fa, xrefs: 028250DE

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 5[fa$5[fa
API String ID: 716092398-996279914
Opcode ID: 631410742e9872aa0b17654480c84f3af61eaa027da4d5c5feae4c643b8d79bb
Instruction ID: fe3a4a8f3199428e78d091fc4fc41e61b4a272c5fd72d3d228d78e1720b15111
Opcode Fuzzy Hash: 631410742e9872aa0b17654480c84f3af61eaa027da4d5c5feae4c643b8d79bb
Instruction Fuzzy Hash: 3C51F0B5D00318AFDF14CF99C984ADEBBB5FF48314F64822AE819AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02823574, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 028251A2

Strings

5[fa, xrefs: 028250BE
5[fa, xrefs: 028250DE

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 5[fa$5[fa
API String ID: 716092398-996279914
Opcode ID: cc42e2cff5c624f71cf034fe9415aae16c8f3398cae00b71e32096c4b3f3dc19
Instruction ID: bd156e9e13a292737b4ed0594243b8cc92cd1cf84cc25b290b2088de0f028fda
Opcode Fuzzy Hash: cc42e2cff5c624f71cf034fe9415aae16c8f3398cae00b71e32096c4b3f3dc19
Instruction Fuzzy Hash: F851E0B4D00318AFDF14CF99C984ADEBBB5BF48314F64812AE819AB250D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0282779C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02827F09

Strings

5[fa, xrefs: 02827E5F

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: CallProcWindow
String ID: 5[fa
API String ID: 2714655100-2404027185
Opcode ID: 494bc28af8f86bfebb5b39d36b741456a46a2d9293a1f5f8b1daa8ddbc7c0df2
Instruction ID: 73dfd3df2c620cb32cacafad56e5bb385b5ac8d13baf67ac52830b0e5817437b
Opcode Fuzzy Hash: 494bc28af8f86bfebb5b39d36b741456a46a2d9293a1f5f8b1daa8ddbc7c0df2
Instruction Fuzzy Hash: 68413BB99002599FDB14CF99C488AABFBF9FF48314F148459E519AB321C774A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02826B61, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02826BEF

Strings

5[fa, xrefs: 02826B87

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: 5[fa
API String ID: 3793708945-2404027185
Opcode ID: 340a552745c8f0c5696cb209cb57bb2c5067893a2798b0fdb318be807c4f40e9
Instruction ID: 4958918c2b3eeeaced3fb2e41d1feed34d109e89ae006bcfd13a0c2af49e2291
Opcode Fuzzy Hash: 340a552745c8f0c5696cb209cb57bb2c5067893a2798b0fdb318be807c4f40e9
Instruction Fuzzy Hash: 9D2114B5900218AFDB10CF99D984ADEFBF8FB48364F14852AE919A3350D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02826B68, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02826BEF

Strings

5[fa, xrefs: 02826B87

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: 5[fa
API String ID: 3793708945-2404027185
Opcode ID: a57ab6e220619737afdd7dbe978c542d428f94a4ca1134ca942c8e7709dc026f
Instruction ID: 33562069b4e6b55ec0672b86d2dcf5be6d3bb13f3d90c15b534d5296f4c93684
Opcode Fuzzy Hash: a57ab6e220619737afdd7dbe978c542d428f94a4ca1134ca942c8e7709dc026f
Instruction Fuzzy Hash: 7021F5B5900218AFDB10CF99D984ADEFBF8FB48324F14842AE915A3350D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0282C198, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0282C212

Strings

5[fa, xrefs: 0282C1AF

Memory Dump Source

Source File: 0000000E.00000002.571354512.0000000002820000.00000040.00000001.sdmp, Offset: 02820000, based on PE: false

Similarity

API ID: EncodePointer
String ID: 5[fa
API String ID: 2118026453-2404027185
Opcode ID: 41c3e5962d097a05648a46d2fd5a71f5c41f3883fefea71a83b3668adf004389
Instruction ID: 46a1212892dc999fbd3d4190b17c297e88e1fa4aac237ee8f1e9ab5cd60b2ddc
Opcode Fuzzy Hash: 41c3e5962d097a05648a46d2fd5a71f5c41f3883fefea71a83b3668adf004389
Instruction Fuzzy Hash: FD11AFB59003158FDB10DFAAD5487AEBBF4EB49314F20802AD409E7241CB386548CF91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.27244

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre