Play interactive tour

Edit tour

Windows Analysis Report vbc.exe_

Overview

General Information

Sample Name:	vbc.exe_ (renamed file extension from exe_ to exe)
Analysis ID:	502670
MD5:	a665b705b9381b33aaa9e307fe340af7
SHA1:	a6fba4f009921b1de9d524047bcb7fa0e571a116
SHA256:	dc07322ef1652695b5e85bfd5d6da8c5b6c311d26ff13eb18a390cd4b7232203
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

vbc.exe (PID: 7088 cmdline: 'C:\Users\user\Desktop\vbc.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

vbc.exe (PID: 6404 cmdline: C:\Users\user\Desktop\vbc.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 4624 cmdline: 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 6176 cmdline: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 3144 cmdline: 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe' MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 5840 cmdline: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

BnevyAj.exe (PID: 4640 cmdline: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe MD5: A665B705B9381B33AAA9E307FE340AF7)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@croatiahunt.com", "Password": "VilaVrgade852", "Host": "mail.croatiahunt.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 7088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 7088	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vbc.exe PID: 6404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 6404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BnevyAj.exe PID: 4624	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 4624	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BnevyAj.exe PID: 6176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 6176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BnevyAj.exe PID: 3144	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 3144	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: BnevyAj.exe PID: 4640	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: BnevyAj.exe PID: 4640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.vbc.exe.3a55230.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.3a55230.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37d5230.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37d5230.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
14.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.3725230.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.3725230.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
18.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
18.2.BnevyAj.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.2801570.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
16.2.BnevyAj.exe.3725230.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.3725230.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.24d1524.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.vbc.exe.3a55230.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.3a55230.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.362bd80.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.362bd80.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.3904960.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.3904960.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37d5230.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.37d5230.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.36dbd80.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.36dbd80.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.395bd80.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.395bd80.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.2581524.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.BnevyAj.exe.3684960.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.BnevyAj.exe.3684960.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.35d4960.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.BnevyAj.exe.35d4960.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 28 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 16.2.BnevyAj.exe.3725230.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@croatiahunt.com", "Password": "VilaVrgade852", "Host": "mail.croatiahunt.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: vbc.exe	Virustotal: Detection: 30%	Perma Link
Source: vbc.exe	Metadefender: Detection: 22%	Perma Link
Source: vbc.exe	ReversingLabs: Detection: 33%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Metadefender: Detection: 22%			Perma Link
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	ReversingLabs: Detection: 44%

Source: 14.2.BnevyAj.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 18.2.BnevyAj.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.vbc.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: vbc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: vbc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic

TCP traffic: 192.168.2.4:49884 -> 116.202.174.203:587

Source: global traffic

TCP traffic: 192.168.2.4:49884 -> 116.202.174.203:587

Source: vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	String found in binary or memory: http://MpOtQG.com
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.c
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: vbc.exe, 00000004.00000003.909645922.00000000067D7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: vbc.exe, 00000004.00000002.933794203.00000000032B0000.00000004.00000001.sdmp	String found in binary or memory: http://croatiahunt.com
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: vbc.exe, 00000004.00000002.933794203.00000000032B0000.00000004.00000001.sdmp	String found in binary or memory: http://mail.croatiahunt.com
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: vbc.exe, 00000004.00000002.933635766.0000000003263000.00000004.00000001.sdmp	String found in binary or memory: http://ryfE27WOGC.c
Source: vbc.exe, 00000004.00000002.933635766.0000000003263000.00000004.00000001.sdmp	String found in binary or memory: http://ryfE27WOGC.com
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vbc.exe, 00000000.00000003.668894572.000000000580D000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlr
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: vbc.exe, 00000000.00000003.680066703.00000000057D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: vbc.exe, 00000000.00000003.680066703.00000000057D0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comldTF
Source: vbc.exe, 00000000.00000003.664625275.00000000057EB000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: vbc.exe, 00000000.00000003.666659224.00000000057D6000.00000004.00000001.sdmp, vbc.exe, 00000000.00000003.666236612.00000000057D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: vbc.exe, 00000000.00000003.666529673.00000000057D6000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: vbc.exe, 00000000.00000003.666467941.00000000057D8000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/l
Source: vbc.exe, 00000000.00000003.666236612.00000000057D7000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnp
Source: vbc.exe, 00000000.00000003.666028561.00000000057DD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnt
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp, vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com.
Source: vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comUz
Source: vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comgz
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: vbc.exe, 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: mail.croatiahunt.com

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 4.2.vbc.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bC8123CFFu002d1084u002d4755u002dA068u002d115455E50C0Au007d/u00351EA55F5u002dCE7Fu002d4200u002dB2DEu002d07232B8B50DB.cs	Large array initialization: .cctor: array initializer size 11948
Source: 14.2.BnevyAj.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bC8123CFFu002d1084u002d4755u002dA068u002d115455E50C0Au007d/u00351EA55F5u002dCE7Fu002d4200u002dB2DEu002d07232B8B50DB.cs	Large array initialization: .cctor: array initializer size 11948
Source: 18.2.BnevyAj.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bC8123CFFu002d1084u002d4755u002dA068u002d115455E50C0Au007d/u00351EA55F5u002dCE7Fu002d4200u002dB2DEu002d07232B8B50DB.cs	Large array initialization: .cctor: array initializer size 11948

Source: vbc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_00ADD064	0_2_00ADD064
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_00ADF298	0_2_00ADF298
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_00ADF296	0_2_00ADF296
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_014BBA18	4_2_014BBA18
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_014B69A0	4_2_014B69A0
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_02F046A0	4_2_02F046A0
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_02F04630	4_2_02F04630
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_05947540	4_2_05947540
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_05942548	4_2_05942548
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_059494F8	4_2_059494F8
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_05946C70	4_2_05946C70
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C1D064	11_2_00C1D064
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C1F296	11_2_00C1F296
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C1F298	11_2_00C1F298
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06CDCAF8	11_2_06CDCAF8
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06CD6D90	11_2_06CD6D90
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06CD6DA0	11_2_06CD6DA0
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_027546A0	14_2_027546A0
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_0275463B	14_2_0275463B
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_02754693	14_2_02754693
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 14_2_0275DA00	14_2_0275DA00

Source: vbc.exe, 00000000.00000002.680415873.00000000003B4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs vbc.exe
Source: vbc.exe, 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dll< vs vbc.exe
Source: vbc.exe, 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameGDufUjPAGIrcCocQttaA.exe4 vs vbc.exe
Source: vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs vbc.exe
Source: vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp	Binary or memory string: m,\\StringFileInfo\\000004B0\\OriginalFilename vs vbc.exe
Source: vbc.exe, 00000004.00000000.679006892.0000000000BE4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs vbc.exe
Source: vbc.exe, 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameGDufUjPAGIrcCocQttaA.exe4 vs vbc.exe
Source: vbc.exe, 00000004.00000002.929243029.0000000000F88000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs vbc.exe
Source: vbc.exe	Binary or memory string: OriginalFilenameIsolatedStorageFi.exe6 vs vbc.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe DC07322EF1652695B5E85BFD5D6DA8C5B6C311D26FF13EB18A390CD4B7232203

Source: vbc.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: BnevyAj.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: vbc.exe	Virustotal: Detection: 30%
Source: vbc.exe	Metadefender: Detection: 22%
Source: vbc.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\vbc.exe

File read: C:\Users\user\Desktop\vbc.exe

Jump to behavior

Source: vbc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vbc.exe 'C:\Users\user\Desktop\vbc.exe'
Source: C:\Users\user\Desktop\vbc.exe	Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe 'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Source: C:\Users\user\Desktop\vbc.exe	Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\vbc.exe

File created: C:\Users\user\AppData\Local\Gottschalks

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/4@2/1

Source: C:\Users\user\Desktop\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: 4.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.2.BnevyAj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 14.2.BnevyAj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.2.BnevyAj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.2.BnevyAj.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: vbc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: vbc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: vbc.exe, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.vbc.exe.340000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.vbc.exe.340000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: BnevyAj.exe.4.dr, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.vbc.exe.b70000.1.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.vbc.exe.b70000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.2.BnevyAj.exe.230000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.BnevyAj.exe.230000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.2.BnevyAj.exe.470000.1.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.0.BnevyAj.exe.470000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.BnevyAj.exe.40000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.2.BnevyAj.exe.40000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.BnevyAj.exe.30000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.2.BnevyAj.exe.30000.0.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 18.2.BnevyAj.exe.5e0000.1.unpack, MapEditor1/CreateMapDialog.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_06E63665 push FFFFFF8Bh; iretd	0_2_06E63667
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_06E6366E push cs; retf	0_2_06E6366F
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_06E60FD2 push eax; ret	0_2_06E60FD9
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_06E60FDA pushad ; ret	0_2_06E60FD1
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_06E60F9C pushad ; ret	0_2_06E60FD1
Source: C:\Users\user\Desktop\vbc.exe	Code function: 4_2_02F0DD38 push FFFFFF8Bh; iretd	4_2_02F0DD3B
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_00C12018 push ebx; retf	11_2_00C1207A
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F63665 push FFFFFF8Bh; iretd	11_2_06F63667
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F6366E push cs; retf	11_2_06F6366F
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F60FDB push eax; ret	11_2_06F60FD9
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F60F9C push eax; ret	11_2_06F60FD9
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F60F45 push es; retf	11_2_06F60F48
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F634BE pushad ; retf	11_2_06F634BF
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Code function: 11_2_06F6346C pushad ; retf	11_2_06F6346D

Source: initial sample	Static PE information: section name: .text entropy: 7.80231606159
Source: initial sample	Static PE information: section name: .text entropy: 7.80231606159

Source: C:\Users\user\Desktop\vbc.exe

File created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe

Jump to dropped file

Source: C:\Users\user\Desktop\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\vbc.exe

File opened: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.vbc.exe.2801570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.24d1524.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.2581524.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 7088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 3144, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\vbc.exe TID: 7092	Thread sleep time: -46038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 6964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 4936	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 5704	Thread sleep count: 721 > 30	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 5704	Thread sleep count: 9117 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 4552	Thread sleep time: -42962s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3000	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3000	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3176	Thread sleep count: 4359 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 3176	Thread sleep count: 5458 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 4812	Thread sleep time: -31879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 5708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 6784	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 5192	Thread sleep count: 8542 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe TID: 5192	Thread sleep count: 1290 > 30	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Window / User API: threadDelayed 721	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Window / User API: threadDelayed 9117	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 4359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 5458	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 8542	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Window / User API: threadDelayed 1290	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 46038	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 42962	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 31879	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe

Memory written: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Process created: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Jump to behavior

Source: vbc.exe, 00000004.00000002.931330746.00000000018A0000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.930350035.0000000001150000.00000002.00020000.sdmp, BnevyAj.exe, 00000012.00000002.930566306.0000000001300000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: vbc.exe, 00000004.00000002.931330746.00000000018A0000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.930350035.0000000001150000.00000002.00020000.sdmp, BnevyAj.exe, 00000012.00000002.930566306.0000000001300000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000004.00000002.931330746.00000000018A0000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.930350035.0000000001150000.00000002.00020000.sdmp, BnevyAj.exe, 00000012.00000002.930566306.0000000001300000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: vbc.exe, 00000004.00000002.931330746.00000000018A0000.00000002.00020000.sdmp, BnevyAj.exe, 0000000E.00000002.930350035.0000000001150000.00000002.00020000.sdmp, BnevyAj.exe, 00000012.00000002.930566306.0000000001300000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Users\user\Desktop\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Users\user\Desktop\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.vbc.exe.3a55230.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37d5230.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.3725230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.3725230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.3a55230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.362bd80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.3904960.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37d5230.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.36dbd80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.395bd80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.3684960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.35d4960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 7088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 3144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4640, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\vbc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4640, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.vbc.exe.3a55230.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37d5230.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.3725230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.BnevyAj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.3725230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.3a55230.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.362bd80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.3904960.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.37d5230.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.36dbd80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.395bd80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BnevyAj.exe.3684960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BnevyAj.exe.35d4960.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 7088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 6176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 3144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BnevyAj.exe PID: 4640, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Registry Run Keys / Startup Folder1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	System Information Discovery114	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Deobfuscate/Decode Files or Information1	Credentials in Registry1	Query Registry1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Security Software Discovery311	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing13	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion131	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion131	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Hidden Files and Directories1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vbc.exe	30%	Virustotal		Browse
vbc.exe	23%	Metadefender		Browse
vbc.exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	23%	Metadefender		Browse
C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	44%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.BnevyAj.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
18.2.BnevyAj.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.2.vbc.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
windowsupdate.s.llnwi.net	0%	Virustotal		Browse
croatiahunt.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.sajatypeworks.com.	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://ryfE27WOGC.c	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.collada.org/2005/11/COLLADASchema9Done	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnp	0%	URL Reputation	safe
http://MpOtQG.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnt	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.founder.com.cn/cn/l	0%	Avira URL Cloud	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sajatypeworks.comgz	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://mail.croatiahunt.com	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://crl.c	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comUz	0%	Avira URL Cloud	safe
http://croatiahunt.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comldTF	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.htmlr	0%	Avira URL Cloud	safe
http://ryfE27WOGC.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
windowsupdate.s.llnwi.net	178.79.242.0	true	false	0%, Virustotal, Browse	unknown
croatiahunt.com	116.202.174.203	true	true	0%, Virustotal, Browse	unknown
mail.croatiahunt.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sajatypeworks.com.	vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://ryfE27WOGC.c	vbc.exe, 00000004.00000002.933635766.0000000003263000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.tiro.com	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.collada.org/2005/11/COLLADASchema9Done	vbc.exe, 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp, vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnp	vbc.exe, 00000000.00000003.666236612.00000000057D7000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://MpOtQG.com	BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnt	vbc.exe, 00000000.00000003.666028561.00000000057DD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/l	vbc.exe, 00000000.00000003.666467941.00000000057D8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%GETMozilla/5.0	BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://www.fonts.com	vbc.exe, 00000000.00000003.664625275.00000000057EB000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comgz	vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	vbc.exe, 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, vbc.exe, 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, BnevyAj.exe, 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
http://mail.croatiahunt.com	vbc.exe, 00000004.00000002.933794203.00000000032B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, BnevyAj.exe, 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, BnevyAj.exe, 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	vbc.exe, 00000000.00000003.680066703.00000000057D0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%$	vbc.exe, 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	vbc.exe, 00000000.00000003.666529673.00000000057D6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	vbc.exe, 00000000.00000003.666659224.00000000057D6000.00000004.00000001.sdmp, vbc.exe, 00000000.00000003.666236612.00000000057D7000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://crl.c	vbc.exe, 00000004.00000003.909588018.00000000067A8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comUz	vbc.exe, 00000000.00000003.664039768.00000000057D3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://croatiahunt.com	vbc.exe, 00000004.00000002.933794203.00000000032B0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comldTF	vbc.exe, 00000000.00000003.680066703.00000000057D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.htmlr	vbc.exe, 00000000.00000003.668894572.000000000580D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	vbc.exe, 00000000.00000002.685762484.00000000069E2000.00000004.00000001.sdmp	false		high
http://ryfE27WOGC.com	vbc.exe, 00000004.00000002.933635766.0000000003263000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.202.174.203	croatiahunt.com	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502670
Start date:	14.10.2021
Start time:	08:44:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vbc.exe_ (renamed file extension from exe_ to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/4@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 17.8% Quality standard deviation: 26.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 58 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 20.199.120.182, 23.203.141.148, 20.199.120.151, 20.82.209.183, 8.247.248.249, 8.247.248.223, 8.247.244.221, 2.20.178.33, 2.20.178.24, 20.54.110.249, 52.251.79.25, 40.112.88.60, 20.199.120.85 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:45:17	API Interceptor	731x Sleep call for process: vbc.exe modified
08:45:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
08:45:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BnevyAj C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
08:45:56	API Interceptor	891x Sleep call for process: BnevyAj.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
116.202.174.203	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Get hash	malicious	Browse
	DHL consignment number_600595460.xlsx	Get hash	malicious	Browse
	Po____211110.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
windowsupdate.s.llnwi.net	REMITTANCE-54324.exe	Get hash	malicious	Browse	178.79.242.128
	Farbestfoods.AP Summary.2752.html	Get hash	malicious	Browse	178.79.242.128
	iAuPyHuUkk.exe	Get hash	malicious	Browse	178.79.242.0
	ORDER CONFIRMATION.exe	Get hash	malicious	Browse	178.79.242.128
	HqiJ8HpbxU.exe	Get hash	malicious	Browse	178.79.242.0
	PEKv5PX7Wq.exe	Get hash	malicious	Browse	178.79.242.0
	R6QyqCNJgljVTjY.exe	Get hash	malicious	Browse	178.79.242.0
	SsbgfSoVLC.exe	Get hash	malicious	Browse	178.79.242.0
	pvHBhNUyIm.exe	Get hash	malicious	Browse	178.79.242.0
	Request For New Qoute - Ist Order.exe	Get hash	malicious	Browse	178.79.242.0
	569vj51Zrs.exe	Get hash	malicious	Browse	178.79.242.0
	correction HAWB.exe	Get hash	malicious	Browse	178.79.242.0
	correction HAWB.exe	Get hash	malicious	Browse	178.79.242.0
	Statement of Account.exe	Get hash	malicious	Browse	178.79.242.128
	Statement of Account.exe	Get hash	malicious	Browse	178.79.242.128
	jh6KzwrXQp.exe	Get hash	malicious	Browse	178.79.242.0
	heX1kOkwqy.exe	Get hash	malicious	Browse	178.79.242.0
	mixsix_20211013-084409.exe	Get hash	malicious	Browse	178.79.242.0
	2rd Quater Order Quotation.zip.xls	Get hash	malicious	Browse	178.79.242.128
	DOC REC EIPT.html	Get hash	malicious	Browse	178.79.242.128

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	GR01DtRd0N.exe	Get hash	malicious	Browse	88.99.75.82
	Payment_Swift,png.exe	Get hash	malicious	Browse	78.46.56.160
	PO 211011-021A.exe	Get hash	malicious	Browse	136.243.159.53
	S27f5MP8Ue	Get hash	malicious	Browse	5.75.211.8
	75lT7DuXrs.exe	Get hash	malicious	Browse	168.119.93.163
	#Ud83d#Udcde-youse.guia-644-46204-282109.htm	Get hash	malicious	Browse	95.217.53.76
	6Vk012xoyn	Get hash	malicious	Browse	144.79.90.35
	tmDSSwkOAM	Get hash	malicious	Browse	94.130.40.209
	8r3HRghvXX	Get hash	malicious	Browse	95.217.66.142
	ARK Survival legit hack by Spyro.exe	Get hash	malicious	Browse	135.181.170.169
	M12s7KNFDg.exe	Get hash	malicious	Browse	138.201.79.103
	NBA 2K21 Cheat by Spyro.exe	Get hash	malicious	Browse	135.181.170.169
	Gsdqz.dll	Get hash	malicious	Browse	116.203.98.109
	4tOOUNDwaW.exe	Get hash	malicious	Browse	188.34.163.98
	7ofFMoirr5.exe	Get hash	malicious	Browse	188.34.163.98
	HUTWMrDhov.dll	Get hash	malicious	Browse	116.203.98.109
	SecuriteInfo.com.W32.AIDetect.malware1.10225.exe	Get hash	malicious	Browse	188.34.163.98
	0q3K4qJqQT.exe	Get hash	malicious	Browse	88.99.75.82
	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Get hash	malicious	Browse	116.202.174.203
	FTdhc25gn8.exe	Get hash	malicious	Browse	88.99.75.82

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe	DHL consignment number_600595460.xlsx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BnevyAj.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.348115897127242
Encrypted:	false
SSDEEP:	24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
MD5:	832D6A22CE7798D72609B9C21B4AF152
SHA1:	B086DE927BFEE6039F5555CE53C397D1E59B4CA4
SHA-256:	9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
SHA-512:	A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log Download File
Process:	C:\Users\user\Desktop\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.348115897127242
Encrypted:	false
SSDEEP:	24:MLUE4KJXE4qpE4Ks2E1qE4qpAE4Kzr7RKDE4KhK3VZ9pKhPKIE4oKFKHKorE4x88:MIHKtH2HKXE1qHmAHKzvRYHKhQnoPtH2
MD5:	832D6A22CE7798D72609B9C21B4AF152
SHA1:	B086DE927BFEE6039F5555CE53C397D1E59B4CA4
SHA-256:	9E5EE72EF293C66406AF155572BF3B0CF9DA09CC1F60ED6524AAFD65553CE551
SHA-512:	A1A70F76B98C2478830AE737B4F12507D859365F046C5A415E1EBE3D87FFD2B64663A31E1E5142F7C3A7FE9A6A9CB8C143C2E16E94C3DD6041D1CCABEDDD2C21
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Deployment, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows

C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe Download File
Process:	C:\Users\user\Desktop\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	564736
Entropy (8bit):	7.0819561487133305
Encrypted:	false
SSDEEP:	6144:0MkhBXuLbabNr+o6RxQbACvuj8qLhT7uu5ziEjPY2hL1Vkebv0duOjwYB:vSBXuLbalbMebAr9LNu3KY8L1u+0j1
MD5:	A665B705B9381B33AAA9E307FE340AF7
SHA1:	A6FBA4F009921B1DE9D524047BCB7FA0E571A116
SHA-256:	DC07322EF1652695B5E85BFD5D6DA8C5B6C311D26FF13EB18A390CD4B7232203
SHA-512:	B7E7FF96DCE12935C71B6E6B6FC74652CD08725D8DE29A91E35B0D4F8F351D14F371E2D48A3AB5FE733003764AF09B6BE6DC6D943112B596FA2B09A7638BBAEE
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 23%, Browse Antivirus: ReversingLabs, Detection: 44%
Joe Sandbox View:	Filename: SecuriteInfo.com.BackDoor.SpyBotNET.25.23695.exe, Detection: malicious, Browse Filename: DHL consignment number_600595460.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.fa..............0..(...t......RF... ...`....@.. ....................................@..................................F..O....`..(q........................................................................... ............... ..H............text...X&... ...(.................. ..`.rsrc...(q...`...r.................@..@.reloc..............................@..B................4F......H.......Lb...O......Y...`................................................0..V.........}.......s....}......}......}.....(.......(......{....r...po......{....r...po........0.............(....&.{.........,....8....sA...%.{.....\|....(....Z.{.....\|....(....Z . &.s....} ...%.}......{ ...(.........(....o........+c...+C.....X.].......,+..(.......{....Z...{....Z.{.....{....o ........X.....\|....(..........-....X.....\|....(..........-......,...o!.....sB........\|....(.....\|....(....s"

C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.0819561487133305
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	vbc.exe
File size:	564736
MD5:	a665b705b9381b33aaa9e307fe340af7
SHA1:	a6fba4f009921b1de9d524047bcb7fa0e571a116
SHA256:	dc07322ef1652695b5e85bfd5d6da8c5b6c311d26ff13eb18a390cd4b7232203
SHA512:	b7e7ff96dce12935c71b6e6b6fc74652cd08725d8de29a91e35b0d4f8f351d14f371e2d48a3ab5fe733003764af09b6be6dc6d943112b596fa2b09a7638bbaee
SSDEEP:	6144:0MkhBXuLbabNr+o6RxQbACvuj8qLhT7uu5ziEjPY2hL1Vkebv0duOjwYB:vSBXuLbalbMebAr9LNu3KY8L1u+0j1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S.fa..............0..(...t......RF... ...`....@.. ....................................@................................

File Icon


Icon Hash:	0c529252d9cce41b

Static PE Info

General
Entrypoint:	0x464652
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61668753 [Wed Oct 13 07:14:27 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x64600	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x27128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x62658	0x62800	False	0.889331178617	data	7.80231606159	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x66000	0x27128	0x27200	False	0.141298921725	data	3.94408724321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x66220	0xe8ac	data
RT_ICON	0x74acc	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x75b74	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7811c	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x7c344	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x8cb6c	0x14	data
RT_GROUP_ICON	0x8cb80	0x4c	data
RT_VERSION	0x8cbcc	0x370	data
RT_MANIFEST	0x8cf3c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Gottschalks 2011
Assembly Version	1.0.0.0
InternalName	IsolatedStorageFi.exe
FileVersion	1.0.0.0
CompanyName	Gottschalks
LegalTrademarks
Comments
ProductName	MapEditor1
ProductVersion	1.0.0.0
FileDescription	MapEditor1
OriginalFilename	IsolatedStorageFi.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2021 08:47:05.213349104 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.235928059 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.236557007 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.534688950 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.536415100 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.557899952 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.558201075 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.581259966 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.623823881 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.685749054 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.714250088 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.714277029 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.714293003 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.714304924 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.714365959 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.714437008 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.716888905 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.753770113 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:05.775552988 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:05.826987982 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.164921045 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.186460972 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.188076973 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.211909056 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.213227987 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.243670940 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.244704962 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.266201973 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.266877890 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.299679041 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.300473928 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.321907997 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.324021101 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.324489117 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.326102972 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.326271057 CEST	49884	587	192.168.2.4	116.202.174.203
Oct 14, 2021 08:47:06.345870972 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.345899105 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.347266912 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.347373962 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.348305941 CEST	587	49884	116.202.174.203	192.168.2.4
Oct 14, 2021 08:47:06.390258074 CEST	49884	587	192.168.2.4	116.202.174.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2021 08:47:04.976264000 CEST	62420	53	192.168.2.4	8.8.8.8
Oct 14, 2021 08:47:05.003859997 CEST	53	62420	8.8.8.8	192.168.2.4
Oct 14, 2021 08:47:05.035196066 CEST	60579	53	192.168.2.4	8.8.8.8
Oct 14, 2021 08:47:05.062493086 CEST	53	60579	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 14, 2021 08:47:04.976264000 CEST	192.168.2.4	8.8.8.8	0x6a38	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)
Oct 14, 2021 08:47:05.035196066 CEST	192.168.2.4	8.8.8.8	0xc729	Standard query (0)	mail.croatiahunt.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 14, 2021 08:45:57.393074989 CEST	8.8.8.8	192.168.2.4	0x91c9	No error (0)	windowsupdate.s.llnwi.net		178.79.242.0	A (IP address)	IN (0x0001)
Oct 14, 2021 08:47:05.003859997 CEST	8.8.8.8	192.168.2.4	0x6a38	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 14, 2021 08:47:05.003859997 CEST	8.8.8.8	192.168.2.4	0x6a38	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)
Oct 14, 2021 08:47:05.062493086 CEST	8.8.8.8	192.168.2.4	0xc729	No error (0)	mail.croatiahunt.com	croatiahunt.com		CNAME (Canonical name)	IN (0x0001)
Oct 14, 2021 08:47:05.062493086 CEST	8.8.8.8	192.168.2.4	0xc729	No error (0)	croatiahunt.com		116.202.174.203	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 14, 2021 08:47:05.534688950 CEST	587	49884	116.202.174.203	192.168.2.4	220-srv1.kuhada.com ESMTP Exim 4.94.2 #2 Thu, 14 Oct 2021 08:47:05 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 14, 2021 08:47:05.536415100 CEST	49884	587	192.168.2.4	116.202.174.203	EHLO 980108
Oct 14, 2021 08:47:05.557899952 CEST	587	49884	116.202.174.203	192.168.2.4	250-srv1.kuhada.com Hello 980108 [102.129.143.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 14, 2021 08:47:05.558201075 CEST	49884	587	192.168.2.4	116.202.174.203	STARTTLS
Oct 14, 2021 08:47:05.581259966 CEST	587	49884	116.202.174.203	192.168.2.4	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: vbc.exe PID: 7088 Parent PID: 6032

General

Start time:	08:45:09
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\vbc.exe'
Imagebase:	0x340000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.682512073.00000000037B9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.681665906.00000000027B1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: vbc.exe PID: 6404 Parent PID: 7088

General

Start time:	08:45:18
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\vbc.exe
Imagebase:	0xb70000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.928707796.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.931931603.0000000002F41000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 4624 Parent PID: 3424

General

Start time:	08:45:54
Start date:	14/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Imagebase:	0x230000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.766014828.0000000003539000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.765416031.0000000002531000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 23%, Metadefender, Browse Detection: 44%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 6176 Parent PID: 4624

General

Start time:	08:45:56
Start date:	14/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Imagebase:	0x470000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000E.00000002.928744553.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.931844597.00000000029A1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 3144 Parent PID: 3424

General

Start time:	08:46:02
Start date:	14/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe'
Imagebase:	0x40000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000010.00000002.786078448.0000000002481000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000010.00000002.786781735.0000000003489000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 5840 Parent PID: 3144

General

Start time:	08:46:06
Start date:	14/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Imagebase:	0x30000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: BnevyAj.exe PID: 4640 Parent PID: 3144

General

Start time:	08:46:06
Start date:	14/10/2021
Path:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\BnevyAj\BnevyAj.exe
Imagebase:	0x5e0000
File size:	564736 bytes
MD5 hash:	A665B705B9381B33AAA9E307FE340AF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000012.00000002.928744367.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.931305015.0000000002991000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: vbc.exe PID: 7088 Parent PID: 6032 vbc.exeCOMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	7

Executed Functions

Function 00ADA2D0, Relevance: 1.7, APIs: 1, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ADA516

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fd198712c0154c64baaa557c458417f9599fcc851dd5f30dd30c03a52e1547af
Instruction ID: a0bd81351ab57119af749e6a8c17c7480419dddba67f57f74438f0237783cf56
Opcode Fuzzy Hash: fd198712c0154c64baaa557c458417f9599fcc851dd5f30dd30c03a52e1547af
Instruction Fuzzy Hash: 23711274A00B058FDB24DF6AD14579AB7F2BF88304F00892ED48ADBB50DB75E9458F92

Uniqueness

Uniqueness Score: -1.00%

Function 00ADAFFC, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ADC7BE,?,?,?,?,?), ref: 00ADC87F

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3472dd51c26c8cb25739ea29e7d62f0aab0c7d50ca3ce62b071e3bb6ad82d267
Instruction ID: c4f03edf84b984d34009158b294a8e396a8c0eb8c44299850797e8ba762192c7
Opcode Fuzzy Hash: 3472dd51c26c8cb25739ea29e7d62f0aab0c7d50ca3ce62b071e3bb6ad82d267
Instruction Fuzzy Hash: B221E9B5D00209AFDB10CF99D884ADEBBF8FB48324F14846AE915B7310D374A944DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC7F0, Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00ADC7BE,?,?,?,?,?), ref: 00ADC87F

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f33073737d60acfc90a86cefdab28fdc2c46547fbb38521793fdcc2fd3084401
Instruction ID: 6e7c930597f335718cd5ea9a370238af6335f0b1715710688210eb94b3ddb183
Opcode Fuzzy Hash: f33073737d60acfc90a86cefdab28fdc2c46547fbb38521793fdcc2fd3084401
Instruction Fuzzy Hash: 702114B5D00209DFDB10CFA9D484AEEBBF5FB08320F14846AE959A3350C778A954DF64

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9DA0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ADA591,00000800,00000000,00000000), ref: 00ADA7A2

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2e63d5ad621104891d55ddbd2bbf68e2e19683bb137b0e80a1901512cc31d0b3
Instruction ID: cb49a893da1569f9f4584743640bb58b3b23b442c7b3af566a808ab4f8069518
Opcode Fuzzy Hash: 2e63d5ad621104891d55ddbd2bbf68e2e19683bb137b0e80a1901512cc31d0b3
Instruction Fuzzy Hash: A71114B69002089FDB10CF9AD448BDEFBF8EB98324F14842AD51AB7300C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA731, Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00ADA591,00000800,00000000,00000000), ref: 00ADA7A2

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e008ddfab9a3a62a46ca46f46a40eb7ff625ca90824c150face67e678c35c13b
Instruction ID: 99857792737b6a6829efdf8316c7715f899052949a8e44c8a618b394bb21927e
Opcode Fuzzy Hash: e008ddfab9a3a62a46ca46f46a40eb7ff625ca90824c150face67e678c35c13b
Instruction Fuzzy Hash: BB1126B6D002498FDB10CF99D444BDEFBF5AF48314F14842ED95AA7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA4B0, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00ADA516

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e4f0043666904d6596d7a53cb043ea41ad321329e4d966d3766ad9f5af4e453c
Instruction ID: 96280dfe06c0d24c4c712e075fa4ed05e770b2b1a0b47a700b9a657118eeba3d
Opcode Fuzzy Hash: e4f0043666904d6596d7a53cb043ea41ad321329e4d966d3766ad9f5af4e453c
Instruction Fuzzy Hash: 9511D2B5D006498FDB10CF9AD448BDEFBF4EB48324F14846AD46AB7600C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E614DA, Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 06E6153D

Memory Dump Source

Source File: 00000000.00000002.686631313.0000000006E60000.00000040.00000001.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e60000_vbc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4fcf9a05b3820db01b33a08577ce2b36d230e0a73a2d2f259957431c45f4aab6
Instruction ID: 40ba16f9643599c06d7520a2c79a7d97d544e09f177e5bb407f35033af9853b7
Opcode Fuzzy Hash: 4fcf9a05b3820db01b33a08577ce2b36d230e0a73a2d2f259957431c45f4aab6
Instruction Fuzzy Hash: 9D1103B59003499FDB10DF99D889BDFFBF8EB48324F14841AE559A7600C374A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E614E0, Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 06E6153D

Memory Dump Source

Source File: 00000000.00000002.686631313.0000000006E60000.00000040.00000001.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e60000_vbc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 09a1e164bd44e9a8b22d3c4c8dc060baa00d551be343c39432100b7fd44aced7
Instruction ID: a25ad14dbd6d0a7c95732abd1e91579f4a4ddc5c13a199d03b49d9bf4f25a3fb
Opcode Fuzzy Hash: 09a1e164bd44e9a8b22d3c4c8dc060baa00d551be343c39432100b7fd44aced7
Instruction Fuzzy Hash: A211D3B59003499FDB10DF9AD889BDEFBF8EB48324F14845AE555A7200C375A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ADF298, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4d517a311f746d7c3c9b8469bf4ffe8b580c68e49ccc41fb774c2fc74896fb
Instruction ID: 0c353e6942c3d3120d819fc5b288376584d69a6aa2433b078980ef40e8a4f53e
Opcode Fuzzy Hash: bd4d517a311f746d7c3c9b8469bf4ffe8b580c68e49ccc41fb774c2fc74896fb
Instruction Fuzzy Hash: D312B7F9E917468BE710CF65E8881893FE1B765328BD0CA0BD2611BAD1D7B4116ECF48

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD064, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d2d4fecec87de881e8af78da902b8d9b9f01a9017149bc20c9ca0473a2afde
Instruction ID: b536a71a99cce133c45dfe33a073fd393636b92f2974c0448a42290744c1c751
Opcode Fuzzy Hash: 99d2d4fecec87de881e8af78da902b8d9b9f01a9017149bc20c9ca0473a2afde
Instruction Fuzzy Hash: 87A15C36E0021A8FCF15DFA5C9449DEBBF2FF85310B15856AE906AB321EB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00ADF296, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.681086956.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92332ec51dc644e434f4f71d8b87701b2193c97098aa2c75ce533f0f8cf672a8
Instruction ID: 525a4596a83232c2d5a04c1737cb8ecf8124b4bcee28e6ab8c767c7b10cecfcb
Opcode Fuzzy Hash: 92332ec51dc644e434f4f71d8b87701b2193c97098aa2c75ce533f0f8cf672a8
Instruction Fuzzy Hash: E7C109B9E917458BD710CF65E8882897FF1BB65328F91CB0BD2612B6D0D7B4106ACF48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 6404 Parent PID: 7088 vbc.exeCOMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	153
Total number of Limit Nodes:	9

Executed Functions

Function 014BBA18, Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.930593886.00000000014B0000.00000040.00000010.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14b0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc41420b28f3446ae0edf42c6e0224d0a6fd37432cd193e2b9065540b15d551
Instruction ID: cac49283b40225c4a4f8124add88338683d18a1b411e63a558c4b45036aa36db
Opcode Fuzzy Hash: acc41420b28f3446ae0edf42c6e0224d0a6fd37432cd193e2b9065540b15d551
Instruction Fuzzy Hash: 96F13A34A002098FDB14DFA9C898BEEBBF2FF48314F15856AE405AF365DB70A945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02F06940, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F069A0
GetCurrentThread.KERNEL32 ref: 02F069DD
GetCurrentProcess.KERNEL32 ref: 02F06A1A
GetCurrentThreadId.KERNEL32 ref: 02F06A73

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1146c8d830c235d6cda585dd1081fb145142919645644c0a720538f18bb97f64
Instruction ID: e641ba700fa0ef076d951a86debf5eacf9cbeb2a39ed8209fb9fd1041548a0e5
Opcode Fuzzy Hash: 1146c8d830c235d6cda585dd1081fb145142919645644c0a720538f18bb97f64
Instruction Fuzzy Hash: 3F5157B4D002499FDB14CFA9D9887EEBBF9EF48304F208469E119A7390D7746884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F03D42, Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02F04116

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3c08bcac882111dc37484efdc1ea53550c6fc8041982b01fe8af0e4a6c362a45
Instruction ID: 0e058b2115d7cb2cb4df2b0ecc711ae97fff79f216c3a32138cf5b1c03506782
Opcode Fuzzy Hash: 3c08bcac882111dc37484efdc1ea53550c6fc8041982b01fe8af0e4a6c362a45
Instruction Fuzzy Hash: 51C17D74A007058FCB18EFB9C4946AEBBF6FF88344B00896AD516DB795DF34E8458B90

Uniqueness

Uniqueness Score: -1.00%

Function 02F05090, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02F051A2

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 889b50d21e809055ad9ea3b506dba4cb82088f319b24f4c28247f6f10682c325
Instruction ID: 9630f347ecf2583d6af1db073cebf292d7a19b2008f4683f87fa0d263938b06b
Opcode Fuzzy Hash: 889b50d21e809055ad9ea3b506dba4cb82088f319b24f4c28247f6f10682c325
Instruction Fuzzy Hash: 4841C3B1D003089FDF14CF99D884ADEBBB5BF48354F64812AE919AB250D7B59845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F05084, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02F051A2

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f3619b62f01a06956ba47f25469c99543a40205c4f10298228224e6e3def0582
Instruction ID: 7a622196d3b0930dd43ee945be98bdd7cda3f18b32e50dee689bfb2a3e99a27e
Opcode Fuzzy Hash: f3619b62f01a06956ba47f25469c99543a40205c4f10298228224e6e3def0582
Instruction Fuzzy Hash: 8251E2B1D00308DFEF14CF99D884ADEBBB5BF48354F64812AE919AB250D7B09885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02F0779C, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02F07F09

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9671ddb8ed4e80bc0bcf139ae2c9e4e97158046c3bd1069810f029adea3f9f76
Instruction ID: 51f3d1965507236018a460420968e0b1e7c163027a8c01a789a9d38daf8feb42
Opcode Fuzzy Hash: 9671ddb8ed4e80bc0bcf139ae2c9e4e97158046c3bd1069810f029adea3f9f76
Instruction Fuzzy Hash: 0D414BB5A00205DFCB14DF99C488BAAFBF9FF88314F148499E519AB361C774A841DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F0C189, Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02F0C212

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 3bd61c37a7f8c966adb429ef479be89fcc832c80b064826726150fa44b54fc7f
Instruction ID: 40d21b78865dcd5385161091653b3a065e57973c151c7309a714597e31e46a79
Opcode Fuzzy Hash: 3bd61c37a7f8c966adb429ef479be89fcc832c80b064826726150fa44b54fc7f
Instruction Fuzzy Hash: B931D4718053448FDB20DFA9E98939EBFF4EB49358F14445AE489AB2C2C7795844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F06B68, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F06BEF

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4adbb699a01e88e52f3746f01109a525c2502f2c6dd142a00400d215c5b32c02
Instruction ID: 6944cc8ca4aff38a01624d843689adbffb40e1e71d04cc2e71be7c2b61346525
Opcode Fuzzy Hash: 4adbb699a01e88e52f3746f01109a525c2502f2c6dd142a00400d215c5b32c02
Instruction Fuzzy Hash: C321F3B5D00248AFDB10CFA9D984ADEFBF8FB48324F14842AE915A3350D374A954DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02F06B62, Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F06BEF

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 252434829ae2fac616d2a17412c8586b34fd375864006d33e5abfdda5eb960db
Instruction ID: 2215ba648d955123e97906451889256614562a2314741936d4e3a4b5da885948
Opcode Fuzzy Hash: 252434829ae2fac616d2a17412c8586b34fd375864006d33e5abfdda5eb960db
Instruction Fuzzy Hash: 8121E2B5D00208AFDB10CFA9D984AEEBBF8FB08364F14842AE955B3350D374A954DF60

Uniqueness

Uniqueness Score: -1.00%

Function 014B6AF8, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,014B7D19,00000800), ref: 014B7DAA

Memory Dump Source

Source File: 00000004.00000002.930593886.00000000014B0000.00000040.00000010.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14b0000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e7e58852eb380893c916559bb56203c8f868b1784f5043476ec8283fb81a5f31
Instruction ID: a742544ef6c2abe996a2e1bb3df1b4f79d016714e0de3d32a1935325d923d223
Opcode Fuzzy Hash: e7e58852eb380893c916559bb56203c8f868b1784f5043476ec8283fb81a5f31
Instruction Fuzzy Hash: 9B11EAB69002099FDB10CF9AD484BEEFBF8EB88354F14842AD515B7350C375A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014B7D39, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,014B7D19,00000800), ref: 014B7DAA

Memory Dump Source

Source File: 00000004.00000002.930593886.00000000014B0000.00000040.00000010.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14b0000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cb9b1fe94f0df6d2df919636c783509ba6b119f15607ed23c90058eed09bb477
Instruction ID: b589f6cfb72ca22e5daeb7dffc3759fdf68df840d6f2f23dbc30d1db87fd3718
Opcode Fuzzy Hash: cb9b1fe94f0df6d2df919636c783509ba6b119f15607ed23c90058eed09bb477
Instruction Fuzzy Hash: 442106B69002489FDB10CF99D444AEEFBF8EB88360F14842AD555A7650C375A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F0C198, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02F0C212

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1030383a2264b1f1ac0f2b101d2961bef27f08887255236cedd35bfb7450b3fa
Instruction ID: a623f359d8a9bb5f02627ecb6d7dc13bbf7fedaad40a0710b26ff7385d2f380a
Opcode Fuzzy Hash: 1030383a2264b1f1ac0f2b101d2961bef27f08887255236cedd35bfb7450b3fa
Instruction Fuzzy Hash: DF11A9719003098FDB20CFA9D58879EBBF8FB48394F20852AD445E7681C7396944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F03300, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02F04116

Memory Dump Source

Source File: 00000004.00000002.931743381.0000000002F00000.00000040.00000001.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2f00000_vbc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e0f800f9c0e0714fd2965d351cd26c5311bfde74d27dbc9839caf30b8c6b621a
Instruction ID: 0b4f2633f924d2a26fc5eae0cff9fd0a23c313841535eea79a358b62af0d119a
Opcode Fuzzy Hash: e0f800f9c0e0714fd2965d351cd26c5311bfde74d27dbc9839caf30b8c6b621a
Instruction Fuzzy Hash: ED1146B6D006498FDB20DF9AD484BDEFBF4EF48254F10842ADA29B7640C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014BA8E8, Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 014BB855

Memory Dump Source

Source File: 00000004.00000002.930593886.00000000014B0000.00000040.00000010.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14b0000_vbc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 13f2d1e474613105b98418fdc541f522f827de938635e9426aa7b4d7ac175ced
Instruction ID: 5dcf3c00c85197e96d16e01b57052c368e8e28686268f1fc2a7594fd07aaeddf
Opcode Fuzzy Hash: 13f2d1e474613105b98418fdc541f522f827de938635e9426aa7b4d7ac175ced
Instruction Fuzzy Hash: 6F1115B59006489FCB20CF99D488BDEFBF8EB48324F24886AD519B7310C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014BB7F8, Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 014BB855

Memory Dump Source

Source File: 00000004.00000002.930593886.00000000014B0000.00000040.00000010.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14b0000_vbc.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ea3f1773e07e9d023940bc2933243ef23881477cdc9fcd902ab087adf75c94b7
Instruction ID: 2d98c94ff4c6445b27088e4b2ce3b1be1fa3142ccb16884f7f38a2e6bc07a960
Opcode Fuzzy Hash: ea3f1773e07e9d023940bc2933243ef23881477cdc9fcd902ab087adf75c94b7
Instruction Fuzzy Hash: 881115B59006498FCB20CFD9E4897DEBBF4EB48324F14882AD519B7710C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.930655304.00000000014CD000.00000040.00000001.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14cd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bd3adf4a3a4907e501af39ea0e50c95182ce628b655f6ec7c93683842b9b0c
Instruction ID: a74433483c49d915d45c5d14c4e746cf5b6418a1cb9ed858fa467ed76400b328
Opcode Fuzzy Hash: 19bd3adf4a3a4907e501af39ea0e50c95182ce628b655f6ec7c93683842b9b0c
Instruction Fuzzy Hash: 6C2125B9904200DFCB55CF98D8C0B16BBA5FB84B58F20C97ED84A4B356C336D847CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.930655304.00000000014CD000.00000040.00000001.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_14cd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029b3e22b451d304ae4d725829db579580ff9ffc933480e1a21aa19f8765a0b1
Instruction ID: c2690bdd266d089056eddd882bdf857e8a9667c9971ac6cc789a6e4f42f4d183
Opcode Fuzzy Hash: 029b3e22b451d304ae4d725829db579580ff9ffc933480e1a21aa19f8765a0b1
Instruction Fuzzy Hash: 2B2183755093808FCB12CF24D594716BF71EB46214F28C5EFD8458B667C33A980ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BnevyAj.exe PID: 4624 Parent PID: 3424 BnevyAj.exeCOMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	199
Total number of Limit Nodes:	11

Executed Functions

Function 06CDEC98, Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CDEECE

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 352302f1aca0ad8012db0db8944b3d03b1bb9ea0961190c7f0bc571775d4949b
Instruction ID: 3fdfc5e95d0f3297276d37333aed08a89e281c51c993ceba21b1d00b941a07eb
Opcode Fuzzy Hash: 352302f1aca0ad8012db0db8944b3d03b1bb9ea0961190c7f0bc571775d4949b
Instruction Fuzzy Hash: 62913A71D00219CFDF64CFA8C8807EEBAB2FF48314F148569D919AB290DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1A516

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1997b6bd022c175cf8c211c95610b371451bd86b1214b397be9e59a27bee038d
Instruction ID: 738782615a6b909eea62264fd1c349ba4c1426f9d2f0b8fa4940c8ced0b5a6ae
Opcode Fuzzy Hash: 1997b6bd022c175cf8c211c95610b371451bd86b1214b397be9e59a27bee038d
Instruction Fuzzy Hash: 0A714570A00B058FDB24DF6AD04579AB7F1FF89304F00892EE09AD7A50D775E985DB92

Uniqueness

Uniqueness Score: -1.00%

Function 06CDEA10, Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CDEAA0

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bcee7c3b069bdd14d6474389919a5e9bf6f0329d4cd96b85991e4c152fea04e2
Instruction ID: be5be5ae5c643186e878f671eeda9aa35aa64ff27321d7cda13dcade1cd854c2
Opcode Fuzzy Hash: bcee7c3b069bdd14d6474389919a5e9bf6f0329d4cd96b85991e4c152fea04e2
Instruction Fuzzy Hash: FA2127B59003499FCF10CFA9C884BEEBBF5FF48314F10882AE919A7240D7789944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1C7F0, Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C1C7BE,?,?,?,?,?), ref: 00C1C87F

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb3ee43eef8ea5b229e266d76e5c2fa42323c2d88034da96aba74b99628646e3
Instruction ID: 88627b76e6c5355fc5fbe41475e01a37a11ceae37bf26ddf224f141631fc7889
Opcode Fuzzy Hash: cb3ee43eef8ea5b229e266d76e5c2fa42323c2d88034da96aba74b99628646e3
Instruction Fuzzy Hash: 4B2105B59002489FDB10CFA9D884ADEFFF8EB48320F14842AE919A7350D374A944DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1AFFC, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C1C7BE,?,?,?,?,?), ref: 00C1C87F

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 52b17b73171b730727d5a0a69daab560f09ef6dab387e2462ed96184ef923ebe
Instruction ID: a986060befce2384086dd6a80517e87611499d5c8fa5ae4ae21a94aceab76cf3
Opcode Fuzzy Hash: 52b17b73171b730727d5a0a69daab560f09ef6dab387e2462ed96184ef923ebe
Instruction Fuzzy Hash: 9F2119B5D00208AFDB10CF99D884ADEBBF8FB48310F14842AE915B7350D374A944DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CDEB00, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CDEB80

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2716e904da49920c6bd6d520b78360c57d7a954816929eedb2c4fbfcd97f6a85
Instruction ID: 509b415bbacd16c8c69e0f2d5b03b1a018cf5933ef2615060739d10b7a019168
Opcode Fuzzy Hash: 2716e904da49920c6bd6d520b78360c57d7a954816929eedb2c4fbfcd97f6a85
Instruction Fuzzy Hash: F02116B19003499FCB10CFA9C884AEEBBF5FF48324F50882AE519A7240C7749944DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CDE878, Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06CDE8F6

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 4ca179e41ec79a86bf972c2ca2f06c40555ec6fbd84ecf3ac82d830759732b21
Instruction ID: 4f91b269fb82c322a0eb399716a795083daea67f9e1c13bb475b64c9bb3888bf
Opcode Fuzzy Hash: 4ca179e41ec79a86bf972c2ca2f06c40555ec6fbd84ecf3ac82d830759732b21
Instruction Fuzzy Hash: 60214971D003099FDB50CFAAC8847EFBBF9EF48224F54842AD519A7240CB789985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A731, Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1A591,00000800,00000000,00000000), ref: 00C1A7A2

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b20ed5268fd5de49658b11cd022592ce7b9a8b1e2bdb08cf553684854884d7d0
Instruction ID: 18e8dc0c2e7fb9944fcabb075fa331348db8b23cfb77a6cc27e53f832add6ce1
Opcode Fuzzy Hash: b20ed5268fd5de49658b11cd022592ce7b9a8b1e2bdb08cf553684854884d7d0
Instruction Fuzzy Hash: DC1117B59002499FDB10CFAAD444BDEFBF8AF49324F14842AD515A7200C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C19DA0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C1A591,00000800,00000000,00000000), ref: 00C1A7A2

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 74fca1b38d4d6cef2f8cd7a7d7bd6822ba4eed793a2226f7163da8c755b61e47
Instruction ID: de0cbcc86c94bf52136020764b76e8650babf4896000d31aa4bbfdc6794f7451
Opcode Fuzzy Hash: 74fca1b38d4d6cef2f8cd7a7d7bd6822ba4eed793a2226f7163da8c755b61e47
Instruction Fuzzy Hash: 1A1117B69012499FDB10CF9AD444BDEFBF4EB48324F14842AD525A7240C375AA85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CDE950, Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CDE9BE

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 781a2c958c0eaf03f4e301c8355326c778707188a2bef3f4380e73c665eaec88
Instruction ID: 9daa405f657a02b1bc5d7a775334694a000cf359a8d3af27f0eb8d7feb03ccd5
Opcode Fuzzy Hash: 781a2c958c0eaf03f4e301c8355326c778707188a2bef3f4380e73c665eaec88
Instruction Fuzzy Hash: C11149759002499FCF10DFA9D844BEFBBF9EF48324F14882AD515A7250C7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F61F9C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06F62751,?,?), ref: 06F628F8

Memory Dump Source

Source File: 0000000B.00000002.770136509.0000000006F60000.00000040.00000001.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6f60000_BnevyAj.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 737c2abf8658991fa1242b0f0ca9cae12de910eaa545d20ba2ec1057455442b9
Instruction ID: 9188c73d79396868818d4d27852bc95cfcb3b3236540d89d0f2c911fc7e8fc0d
Opcode Fuzzy Hash: 737c2abf8658991fa1242b0f0ca9cae12de910eaa545d20ba2ec1057455442b9
Instruction Fuzzy Hash: 71116AB18003498FDB10CF9AC4447DEBBF4EB48324F10842AE555B7340C338A644CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F62898, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,06F62751,?,?), ref: 06F628F8

Memory Dump Source

Source File: 0000000B.00000002.770136509.0000000006F60000.00000040.00000001.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6f60000_BnevyAj.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b5672db12bee7155d7f52ef848dcab6e95fa624e944e2b9be14f4d3cf7a2756b
Instruction ID: 9b34f281fd1976e571ab4072e86cb03cb77d55b2ba2f7f8058da17ea28a339c6
Opcode Fuzzy Hash: b5672db12bee7155d7f52ef848dcab6e95fa624e944e2b9be14f4d3cf7a2756b
Instruction Fuzzy Hash: 62113AB58003499FCB10CFA9D845BDEBBF4EB48324F14842AD555A7640C778A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CDE7C8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CDE82A

Memory Dump Source

Source File: 0000000B.00000002.769824745.0000000006CD0000.00000040.00000001.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_BnevyAj.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2f6ad1ea69cbfc51d57e0bee7bfab76be87633f8c3f2cea2b220ef3a2d039a07
Instruction ID: df6f8af903c03aaa466787a97597c615adbe66810193c25849eb8aae9fc5f2cb
Opcode Fuzzy Hash: 2f6ad1ea69cbfc51d57e0bee7bfab76be87633f8c3f2cea2b220ef3a2d039a07
Instruction Fuzzy Hash: 84113AB1D002488BCB14DFAAD8447EFFBF9EF48224F14882AC519A7240C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1A4B0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C1A516

Memory Dump Source

Source File: 0000000B.00000002.765016948.0000000000C10000.00000040.00000001.sdmp, Offset: 00C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c10000_BnevyAj.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f940dcb2bcecc1d723ae24f94cc9df891234219b0891a08bf50da41ec6188f3b
Instruction ID: f20071352d294bc65bef30868b31e038af45e0ec5be6edcba3d99147a3695936
Opcode Fuzzy Hash: f940dcb2bcecc1d723ae24f94cc9df891234219b0891a08bf50da41ec6188f3b
Instruction Fuzzy Hash: DE11D2B5D006498FDB10CF9AD444BDEFBF5EB49324F14842AD429B7600C375A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F614DB, Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06F6153D

Memory Dump Source

Source File: 0000000B.00000002.770136509.0000000006F60000.00000040.00000001.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6f60000_BnevyAj.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 45e2f7211612250d2d31da670dd07eec3ccbccd59de84f4e398798021393faee
Instruction ID: 16dad09a3edde311e0bdc637a08aeef1e08227e8a04934644a31f35e90a06aba
Opcode Fuzzy Hash: 45e2f7211612250d2d31da670dd07eec3ccbccd59de84f4e398798021393faee
Instruction Fuzzy Hash: F011E5B58002499FDB10DF9AD885BDEFFF8EB48324F14841AE559A7600D375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06F614E0, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06F6153D

Memory Dump Source

Source File: 0000000B.00000002.770136509.0000000006F60000.00000040.00000001.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6f60000_BnevyAj.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7a1ee5483defc64f0df442d1cdd7b800928ac73aa6ec5a3525822060ef347cd4
Instruction ID: 2c47a38dc61bda487f4ea3e8c65abe178991647bb338f094cd5faedd0e4a9ebd
Opcode Fuzzy Hash: 7a1ee5483defc64f0df442d1cdd7b800928ac73aa6ec5a3525822060ef347cd4
Instruction Fuzzy Hash: 8411E5B58003499FDB10CF9AD885BDEFBF8EB48324F14841AE555A7600C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.764799477.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a7d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7f8e3e202e0b6df46450fb73ce1a9d4e944f18c9f945088d9c2f589313adcd
Instruction ID: 9ee4ca14d209659ab05556c6a6fad26914416534986ddec42182711f6a358e7b
Opcode Fuzzy Hash: 2c7f8e3e202e0b6df46450fb73ce1a9d4e944f18c9f945088d9c2f589313adcd
Instruction Fuzzy Hash: 0E21F2B5604204EFDB01DF50D9C0BA6BBB5FF84314F24CAADE84D5B242C336E846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.764799477.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a7d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a57a5a708141e96c67b3158c2a219f69a3eac741f76a9f9a25e25dc3e3ff98
Instruction ID: 461f4c65aa2680df4631595b84356107c960bd3e1e58a94803b31e3aeeb36ab3
Opcode Fuzzy Hash: 53a57a5a708141e96c67b3158c2a219f69a3eac741f76a9f9a25e25dc3e3ff98
Instruction Fuzzy Hash: 0721CF755042449FCB14DF24D9C4B66BBB9FB84314F24C969D84E4B246C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.764799477.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a7d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86f2de99ec1161d51e18b5338a86f7dc671da5c7bfce76c4b26265ca7ca4586
Instruction ID: b8ee9c853fbb94b67660369ea9e26fddd5cdcdab4c6f4369521e7cb4afdfed2e
Opcode Fuzzy Hash: b86f2de99ec1161d51e18b5338a86f7dc671da5c7bfce76c4b26265ca7ca4586
Instruction Fuzzy Hash: 02118B75504280DFCB11CF14E9C4B15BBB1FB84324F28C6AAD84A4B656C33AD85BCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A7D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.764799477.0000000000A7D000.00000040.00000001.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a7d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86f2de99ec1161d51e18b5338a86f7dc671da5c7bfce76c4b26265ca7ca4586
Instruction ID: 71823ec7bccf1e934cb4ea5e12b074595dbe1a8e61a207177c28076966b271a1
Opcode Fuzzy Hash: b86f2de99ec1161d51e18b5338a86f7dc671da5c7bfce76c4b26265ca7ca4586
Instruction Fuzzy Hash: B0118B75504280DFCB11CF10D9C4B55BBB1FF84324F28C6A9D8494B656C33AD84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BnevyAj.exe PID: 6176 Parent PID: 4624 BnevyAj.exeCOMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	6

Executed Functions

Function 0275691F, Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 027569A0
GetCurrentThread.KERNEL32 ref: 027569DD
GetCurrentProcess.KERNEL32 ref: 02756A1A
GetCurrentThreadId.KERNEL32 ref: 02756A73

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b030c58f6ccf84f1d9e77637c08e8a5efd82a7b13cabb246575dd3e36ddc3508
Instruction ID: 0456ddeadc1e34cc4aa9b9596149cd53d1356ddb9def17da9d06fc485b6f028e
Opcode Fuzzy Hash: b030c58f6ccf84f1d9e77637c08e8a5efd82a7b13cabb246575dd3e36ddc3508
Instruction Fuzzy Hash: 0E5188B09046888FDB10CFA9D548BDEFBF4EF48304F14846EE449A7351D7749884CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02756940, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 027569A0
GetCurrentThread.KERNEL32 ref: 027569DD
GetCurrentProcess.KERNEL32 ref: 02756A1A
GetCurrentThreadId.KERNEL32 ref: 02756A73

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f9d1fd39f043419fe10ffc9adab2d6cf9317cbfadc864a763d553b4b00992ad3
Instruction ID: 02ada1a833c0f493ecb113e26d07bf7c516b585cc0c9b523ddeedb36ae8b98a5
Opcode Fuzzy Hash: f9d1fd39f043419fe10ffc9adab2d6cf9317cbfadc864a763d553b4b00992ad3
Instruction Fuzzy Hash: 715165B49006488FDB14CFA9D548BEEFBF5EF88314F208469E419A7350D774A884CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0275500F, Relevance: 1.7, APIs: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58e5b2d3967d6b4d7e29b6f6f43f2e5dfd187e7ac475eaf5d5b2ab135bbe1a6
Instruction ID: cbaaaf7ec36138a6d8702509d06de293af19b3051f2e1375880e0eb93c548096
Opcode Fuzzy Hash: d58e5b2d3967d6b4d7e29b6f6f43f2e5dfd187e7ac475eaf5d5b2ab135bbe1a6
Instruction Fuzzy Hash: D86112B1C05248AFDF01CFA5C884ACDBFB2BF49304F65816AE908AB221D7759845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02755084, Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027551A2

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3df414806da2be042e5a972e2b24b5b3f20a417b6d99b7ec32ec6fc9a9a2f969
Instruction ID: 8bcbe1cacb2a3de2640082cad126d2fe4fd7dcfb4986f8b0cf363787a213c834
Opcode Fuzzy Hash: 3df414806da2be042e5a972e2b24b5b3f20a417b6d99b7ec32ec6fc9a9a2f969
Instruction Fuzzy Hash: 8F51CDB1D003189FDB14CF99D880ADEFFB5BF48314F64822AE819AB210D7B49885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02755090, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 027551A2

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6f9fa5257cb85405029c6936194c905a533c563dbdb33b9bad24229c31c81100
Instruction ID: 33cd031703a8ec2e46caa9f7937f258a9e022f27497a7acc779e2b1b776dc593
Opcode Fuzzy Hash: 6f9fa5257cb85405029c6936194c905a533c563dbdb33b9bad24229c31c81100
Instruction Fuzzy Hash: D441BDB1D003189FDB14CF99C884ADEFFB5BF48314F64852AE819AB210D7B4A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0275779C, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02757F09

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3dbce91c4ff6b2e0bb580fe6811812bd614e0a4bfecb71fa1e795567970b72bf
Instruction ID: 23a65463297b67e136124923b13104d9e81f6256b326dc7cad180b739a7ebee6
Opcode Fuzzy Hash: 3dbce91c4ff6b2e0bb580fe6811812bd614e0a4bfecb71fa1e795567970b72bf
Instruction Fuzzy Hash: 674149B5A003159FDB14CF99C488BAAFBF5FF88314F248459E819AB321D374A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02756B61, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02756BEF

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 20a5a6bf80a23dfdbd1ed9720ef52b137e78ecb5ef459c4519b467d71357e0ad
Instruction ID: ec48dabbbf0119a188df1d0aebd4f6fe101235485a32a227c6b770081d54cda1
Opcode Fuzzy Hash: 20a5a6bf80a23dfdbd1ed9720ef52b137e78ecb5ef459c4519b467d71357e0ad
Instruction Fuzzy Hash: 072114B5900248DFDB00CFA9D584ADEFBF9FB08320F14842AE915A3210D378A945DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02756B68, Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02756BEF

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e1a3bad67d1b615d010e1fdcaac15933f88224eed063c563aa6af0ff31c2d87a
Instruction ID: e05750987005499532d327bc01c50d0ca81b62e0f4f6ee4a5d43500d589fecd2
Opcode Fuzzy Hash: e1a3bad67d1b615d010e1fdcaac15933f88224eed063c563aa6af0ff31c2d87a
Instruction Fuzzy Hash: 3521D3B5900258AFDB10CFA9D984ADEFBF8FB48324F14842AE915A3310D374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0275C198, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0275C212

Memory Dump Source

Source File: 0000000E.00000002.931274165.0000000002750000.00000040.00000001.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2750000_BnevyAj.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 89643d180ac38bcc56f6a5e2e2d4159572ff1d7b6c863e19c2a1e23fc9e4df39
Instruction ID: 95d351202a8cf01b29413b257cc65c2fa86fc52c74420cbd90825e3834ff2e7e
Opcode Fuzzy Hash: 89643d180ac38bcc56f6a5e2e2d4159572ff1d7b6c863e19c2a1e23fc9e4df39
Instruction Fuzzy Hash: 45119AB19003048FDB20CFA9D54879FBBF8EB48714F20852ED805A7641D779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0256D53C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.930655746.000000000256D000.00000040.00000001.sdmp, Offset: 0256D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_256d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb75c6094f306f9412b67fb621ce96b18a0534ccd84e080f2cf58d6b16ea15fc
Instruction ID: 7c19f60d68a9c1c3ac03039e8387919f70017b4c8f05bd59f2de3872b938728f
Opcode Fuzzy Hash: eb75c6094f306f9412b67fb621ce96b18a0534ccd84e080f2cf58d6b16ea15fc
Instruction Fuzzy Hash: 2C2133B1205244DFDF11DF10D8C8B66BF75FB98328F208D69E8054B646C336D846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0257D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.930767164.000000000257D000.00000040.00000001.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_257d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35180d005bd48f39f7358f29fdc563717338093c65f918e94a134c4fc5cf3f3
Instruction ID: 44dea38a53978c9cfd3dfe03d862a9ac24cda423b3ca61c6c3f0f25fca7eacf9
Opcode Fuzzy Hash: c35180d005bd48f39f7358f29fdc563717338093c65f918e94a134c4fc5cf3f3
Instruction Fuzzy Hash: 95212275544204DFDB10CF20E8C4B26BBB5FF84314F24C96DD80A4B246D33BD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0257D006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.930767164.000000000257D000.00000040.00000001.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_257d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459252ab4d1331a13b9ef4bb74492a49d69a5d9efa2d63347bcaf61814ddccee
Instruction ID: edbe01df5f64db5db30bf303d1cf14aba277f01a84e6cd030ab8412ae33d87ba
Opcode Fuzzy Hash: 459252ab4d1331a13b9ef4bb74492a49d69a5d9efa2d63347bcaf61814ddccee
Instruction Fuzzy Hash: 412150755493C08FCB12CF24D994B15BF71FF46214F28C5EAD8898B657C33A944ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0256D537, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.930655746.000000000256D000.00000040.00000001.sdmp, Offset: 0256D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_256d000_BnevyAj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fea46d4023bfcb84ee4c65d7b8a7c4edfa59c4fb92f6e4ed5640399c80934a
Instruction ID: d47395163123b8cebb8299b2d3224702aa04091947741f9d08c913b3baea7319
Opcode Fuzzy Hash: a8fea46d4023bfcb84ee4c65d7b8a7c4edfa59c4fb92f6e4ed5640399c80934a
Instruction Fuzzy Hash: 8011E676504280CFCF12CF10D9C4B26BF72FB84324F24C6A9D8494B656C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report vbc.exe_

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

Function 00ADA2D0, Relevance: 1.7, APIs: 1, Instructions: 191
COMMON

Function 00ADAFFC, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00ADC7F0, Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00AD9DA0, Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00ADA731, Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Function 00ADA4B0, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06E614DA, Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 06E614E0, Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Function 014BBA18, Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Function 02F06940, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 02F03D42, Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Function 02F05090, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 02F05084, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 02F0779C, Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 02F0C189, Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre