Play interactive tour

Edit tour

Windows Analysis Report PO# 6100003560, items 00090 and 00100.exe

Overview

General Information

Sample Name:	PO# 6100003560, items 00090 and 00100.exe
Analysis ID:	553253
MD5:	6181e56a727d1a622764b93f44847b55
SHA1:	35d223985c50bce16e09c4465627dfadff775ced
SHA256:	9c252952a81c86f0d5b5206b35d84a446dd85322f64bafc1b082337ba738f291
Tags:	agentteslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

Creates processes with suspicious names

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

PO# 6100003560, items 00090 and 00100.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe" MD5: 6181E56A727D1A622764B93F44847B55)

PO# 6100003560, items 00090 and 00100.exe (PID: 1444 cmdline: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe MD5: 6181E56A727D1A622764B93F44847B55)

PO# 6100003560, items 00090 and 00100.exe (PID: 4780 cmdline: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe MD5: 6181E56A727D1A622764B93F44847B55)

PO# 6100003560, items 00090 and 00100.exe (PID: 1000 cmdline: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe MD5: 6181E56A727D1A622764B93F44847B55)

PO# 6100003560, items 00090 and 00100.exe (PID: 3112 cmdline: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe MD5: 6181E56A727D1A622764B93F44847B55)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "humhum@nutiribio.com", "Password": "zGNVO(l5", "Host": "smtp.nutiribio.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.932648728.0000000002FE2000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 7120	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 7120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 3112	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 3112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.272f86c.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.2776894.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.2737878.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 18 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "humhum@nutiribio.com", "Password": "zGNVO(l5", "Host": "smtp.nutiribio.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: PO# 6100003560, items 00090 and 00100.exe	Virustotal: Detection: 43%			Perma Link
Source: PO# 6100003560, items 00090 and 00100.exe	ReversingLabs: Detection: 27%

Machine Learning detection for sample

Show sources

Source: PO# 6100003560, items 00090 and 00100.exe

Joe Sandbox ML: detected

Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ConstructorReturnMessa.pdb source: PO# 6100003560, items 00090 and 00100.exe
Source:	Binary string: ConstructorReturnMessa.pdbH source: PO# 6100003560, items 00090 and 00100.exe

Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: http://MBStZn.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.commito
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PO# 6100003560, items 00090 and 00100.exe

.NET source code contains very large array initializations

Show sources

Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007bA23A83EAu002dA498u002d4AEFu002dBB16u002dCCD2EDE07471u007d/A33BCC3Du002d23D1u002d407Du002d9507u002d8DF915F9F7E3.cs

Large array initialization: .cctor: array initializer size 11775

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_003C6AB9	0_2_003C6AB9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B6C994	0_2_00B6C994
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B6EDD8	0_2_00B6EDD8
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B6EDC9	0_2_00B6EDC9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 4_2_002E6AB9	4_2_002E6AB9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 6_2_00226AB9	6_2_00226AB9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 7_2_000A6AB9	7_2_000A6AB9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00B16AB9	8_2_00B16AB9
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FD1878	8_2_00FD1878
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FD7948	8_2_00FD7948
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FDBFA8	8_2_00FDBFA8
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FD8818	8_2_00FD8818
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FD876A	8_2_00FD876A
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_00FD0738	8_2_00FD0738
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_014D46A0	8_2_014D46A0
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_014D45D0	8_2_014D45D0

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: PO# 6100003560, items 00090 and 00100.exe	Virustotal: Detection: 43%
Source: PO# 6100003560, items 00090 and 00100.exe	ReversingLabs: Detection: 27%

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe "C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe"
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO# 6100003560, items 00090 and 00100.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/1@0/0

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: PO# 6100003560, items 00090 and 00100.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ConstructorReturnMessa.pdb source: PO# 6100003560, items 00090 and 00100.exe
Source:	Binary string: ConstructorReturnMessa.pdbH source: PO# 6100003560, items 00090 and 00100.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: PO# 6100003560, items 00090 and 00100.exe, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3c0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PO# 6100003560, items 00090 and 00100.exe.3c0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.2.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.PO# 6100003560, items 00090 and 00100.exe.2e0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.1.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.3.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.2.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.1.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.PO# 6100003560, items 00090 and 00100.exe.220000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.3.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.3.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.2.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.1.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.PO# 6100003560, items 00090 and 00100.exe.a0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.0.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.2.PO# 6100003560, items 00090 and 00100.exe.b10000.1.unpack, yH/xi.cs	.Net Code: cL System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: PO# 6100003560, items 00090 and 00100.exe, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3c0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 0.0.PO# 6100003560, items 00090 and 00100.exe.3c0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.2.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4.2.PO# 6100003560, items 00090 and 00100.exe.2e0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.1.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 4.0.PO# 6100003560, items 00090 and 00100.exe.2e0000.3.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.2.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.1.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 6.2.PO# 6100003560, items 00090 and 00100.exe.220000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 6.0.PO# 6100003560, items 00090 and 00100.exe.220000.3.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.3.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.2.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.1.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 7.2.PO# 6100003560, items 00090 and 00100.exe.a0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 7.0.PO# 6100003560, items 00090 and 00100.exe.a0000.0.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 8.2.PO# 6100003560, items 00090 and 00100.exe.b10000.1.unpack, yH/xi.cs	.Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B6D0F8 push 3C04C2C3h; ret	0_2_00B6D0FD
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B69288 pushfd ; retn 0004h	0_2_00B694DA
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 0_2_00B63E41 push edx; retn 0004h	0_2_00B63E42
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_0136D95C push eax; ret	8_2_0136D95D
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Code function: 8_2_0136E332 push eax; ret	8_2_0136E349

Source: initial sample

Static PE information: section name: .text entropy: 7.23335914978

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File created: \po# 6100003560, items 00090 and 00100.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.272f86c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.2776894.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.2737878.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 7120, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe TID: 7124	Thread sleep time: -38628s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe TID: 7156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe TID: 5564	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe TID: 3080	Thread sleep count: 2971 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe TID: 3080	Thread sleep count: 6893 > 30	Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Window / User API: threadDelayed 2971			Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Window / User API: threadDelayed 6893			Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Thread delayed: delay time: 38628	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Code function: 8_2_00FDCF70 LdrInitializeThunk,

8_2_00FDCF70

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Memory written: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Process created: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Jump to behavior

Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932334947.0000000001880000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932334947.0000000001880000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932334947.0000000001880000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932334947.0000000001880000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.932648728.0000000002FE2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 3112, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 3112, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3763cf8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO# 6100003560, items 00090 and 00100.exe.3799318.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.932648728.0000000002FE2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO# 6100003560, items 00090 and 00100.exe PID: 3112, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping1	Security Software Discovery211	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery114	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing23	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PO# 6100003560, items 00090 and 00100.exe	43%	Virustotal		Browse
PO# 6100003560, items 00090 and 00100.exe	28%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
PO# 6100003560, items 00090 and 00100.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
8.2.PO# 6100003560, items 00090 and 00100.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
8.0.PO# 6100003560, items 00090 and 00100.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.commito	0%	Avira URL Cloud	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://MBStZn.com	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	false		high
http://www.fontbureau.com/designersG	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.tiro.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commito	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.coma	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696933408.0000000000D57000.00000004.00000040.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://MBStZn.com	PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
https://api.ipify.org%GETMozilla/5.0	PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp	false	URL Reputation: safe	low
http://www.fonts.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702657840.00000000068F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, PO# 6100003560, items 00090 and 00100.exe, 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553253
Start date:	14.01.2022
Start time:	15:06:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PO# 6100003560, items 00090 and 00100.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/1@0/0
EGA Information:	Successful, ratio: 40%
HDC Information:	Successful, ratio: 0.3% (good quality ratio 0.1%) Quality average: 18.4% Quality standard deviation: 31%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Execution Graph export aborted for target PO# 6100003560, items 00090 and 00100.exe, PID 1000 because there are no executed function Execution Graph export aborted for target PO# 6100003560, items 00090 and 00100.exe, PID 1444 because there are no executed function Execution Graph export aborted for target PO# 6100003560, items 00090 and 00100.exe, PID 4780 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:07:27	API Interceptor	736x Sleep call for process: PO# 6100003560, items 00090 and 00100.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO# 6100003560, items 00090 and 00100.exe.log Download File
Process:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x847mE4P:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzQ
MD5:	A9EFF9253CAF99EC8665E41D736DDAED
SHA1:	D95BB4ABC856D774DA4602A59DE252B4BF560530
SHA-256:	DBC637B33F1F3CD1AB40AFED23F94C4571CA43621EBB52C5DC267DBDC52D4783
SHA-512:	96B67A84B750589BDB758224641065919F34BBF02BB286B9F5D566B48965A0E38FB88308B61351A6E11C46B76BFEC370FBC8B978A9F0F07A847567172D5CA5F3
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.219699789114028
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO# 6100003560, items 00090 and 00100.exe
File size:	590336
MD5:	6181e56a727d1a622764b93f44847b55
SHA1:	35d223985c50bce16e09c4465627dfadff775ced
SHA256:	9c252952a81c86f0d5b5206b35d84a446dd85322f64bafc1b082337ba738f291
SHA512:	982fad5e912da6016ad49ea29c5d05362bafa1d6bd9024c86ccac30a1b49e01b667666f5eccb4b7c3a4b7f2aafe03439f582c1ddc552454392f013166c14b009
SSDEEP:	12288:pPIK777777777777N7FPlJOS4ww6Ug2gws8+Ww/JiR:pPIK777777777777lFjOSfV2P+Ww/8R
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>7.a............................n.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x49146e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61E1373E [Fri Jan 14 08:41:34 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x91420	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x92000	0x604	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x913c2	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8f474	0x8f600	False	0.755004563535	data	7.23335914978	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x92000	0x604	0x800	False	0.33447265625	data	3.41525161764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x94000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x920a0	0x376	data
RT_MANIFEST	0x92418	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2022 Tradewell
Assembly Version	22.0.0.0
InternalName	ConstructorReturnMessa.exe
FileVersion	1.1.0.0
CompanyName	Tradewell ltd
LegalTrademarks
Comments	Purple Org
ProductName	Blaster
ProductVersion	1.1.0.0
FileDescription	Blaster
OriginalFilename	ConstructorReturnMessa.exe

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 7120 Parent PID: 1496

General

Start time:	15:07:19
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe"
Imagebase:	0x3c0000
File size:	590336 bytes
MD5 hash:	6181E56A727D1A622764B93F44847B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.697067441.000000000274C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 1444 Parent PID: 7120

General

Start time:	15:07:28
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Imagebase:	0x2e0000
File size:	590336 bytes
MD5 hash:	6181E56A727D1A622764B93F44847B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 4780 Parent PID: 7120

General

Start time:	15:07:29
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Imagebase:	0x220000
File size:	590336 bytes
MD5 hash:	6181E56A727D1A622764B93F44847B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 1000 Parent PID: 7120

General

Start time:	15:07:30
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Imagebase:	0xa0000
File size:	590336 bytes
MD5 hash:	6181E56A727D1A622764B93F44847B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 3112 Parent PID: 7120

General

Start time:	15:07:31
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO# 6100003560, items 00090 and 00100.exe
Imagebase:	0xb10000
File size:	590336 bytes
MD5 hash:	6181E56A727D1A622764B93F44847B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000000.693932970.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000000.693014706.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.932514669.0000000002F31000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.932648728.0000000002FE2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000000.694460760.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000000.693491204.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000008.00000002.931334494.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 7120 Parent PID: 1496 PO# 6100003560, items 00090 and 00100.exeCOMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	181
Total number of Limit Nodes:	14

Executed Functions

Function 00B69EF0, Relevance: 1.7, APIs: 1, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B6A136

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 28082ce85c012ff996290dd0038d99d1508fddf4da2e4efbf2c8180a4463075e
Instruction ID: a6e99b3484ed0ca4809847ee47c0afbd6b975cf337dc76f3db057e9be21159db
Opcode Fuzzy Hash: 28082ce85c012ff996290dd0038d99d1508fddf4da2e4efbf2c8180a4463075e
Instruction Fuzzy Hash: DF7114B0A00B058FDB24DF69D14179ABBF5FF88304F00896ED45AD7A40DB79E8458F91

Uniqueness

Uniqueness Score: -1.00%

Function 04D607D0, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04D608E2

Memory Dump Source

Source File: 00000000.00000002.702277270.0000000004D60000.00000040.00000001.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 71d10b9ae0230fc979fc2d8943e51583463405b8d940ba753ab0565324680068
Instruction ID: 67b9e929748192aa2f34bbfac70b7a57ceb5130b9d763d0095fc21a869dea768
Opcode Fuzzy Hash: 71d10b9ae0230fc979fc2d8943e51583463405b8d940ba753ab0565324680068
Instruction Fuzzy Hash: 3B41BFB1D103499FDF15DF9AC884ADEBBF5BF88314F24812AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04D607CF, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04D608E2

Memory Dump Source

Source File: 00000000.00000002.702277270.0000000004D60000.00000040.00000001.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bcffc906237e1ee10c1de2dab734097563f3539a1943f8746eda0d16fc8e1d1b
Instruction ID: d385fe8a6ce9cebe1abaaf24b805a4939a9ac9454f8a4d8c39b29ad35959c189
Opcode Fuzzy Hash: bcffc906237e1ee10c1de2dab734097563f3539a1943f8746eda0d16fc8e1d1b
Instruction Fuzzy Hash: 7241BFB1D103499FDF15DF99C884ADEBFB5BF88314F24812AE819AB210D774A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B63E30, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B65621

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 734170c719a9593a7a41982f94f51edf557aaef4c55eb87fcfbf17d778666bda
Instruction ID: 031498aa018308127da44cf314b27df28f48ef379c4d6327ebcf7d6629bdd95f
Opcode Fuzzy Hash: 734170c719a9593a7a41982f94f51edf557aaef4c55eb87fcfbf17d778666bda
Instruction Fuzzy Hash: 0A410470D00619CFDB24DFA9C8447CEBBF5BF48304F608469D409AB251DB756946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B6556F, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B65621

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 76dac4105289aadc21fe446c9d79a5b345dae1f4d5b8efe01ef606ef8d2b1557
Instruction ID: c1b45f5b4cdd3d6d34cf94168ec52dabdff05e2dbd27bbb348179860548e0eee
Opcode Fuzzy Hash: 76dac4105289aadc21fe446c9d79a5b345dae1f4d5b8efe01ef606ef8d2b1557
Instruction Fuzzy Hash: 8441E171D00619CFDB24DFA9C884BCEBBF5BF88308F608469D408AB251DB796946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04D62D90, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D62E51

Memory Dump Source

Source File: 00000000.00000002.702277270.0000000004D60000.00000040.00000001.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c9a2ec5f2961d4ea2db2aa9cf780822536c0f671e76a03859b1d7c91e901ba9f
Instruction ID: 157f7719e91a690f6d0cb8a39638e217ffb08067a2a7a9842a79b8d642bb6119
Opcode Fuzzy Hash: c9a2ec5f2961d4ea2db2aa9cf780822536c0f671e76a03859b1d7c91e901ba9f
Instruction Fuzzy Hash: E64118B4A00205CFDB14DF99C448AAABBF5FB88314F15C499E419AB321D734E841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B69E90, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B6C0DE,?,?,?,?,?), ref: 00B6C19F

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0c3dca7f96ee68a4a1f54a80efbaee0f8466b7737ddcb4412ab208587cdfefa3
Instruction ID: aabb5fca122d940b049f3d781005b2f844bdcfc12e141b3e3d9026d3fe829626
Opcode Fuzzy Hash: 0c3dca7f96ee68a4a1f54a80efbaee0f8466b7737ddcb4412ab208587cdfefa3
Instruction Fuzzy Hash: B32103B59002089FDB10CFAAD884AEEBFF4EB48320F14805AE954B7311D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B6C111, Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B6C0DE,?,?,?,?,?), ref: 00B6C19F

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d8f0f024ec1c2f8d129628851dbafc74fb2deea2163d2281a73e4302571c3538
Instruction ID: 263fa0cbe55a5f003be3daa0498b8267456a5e5aa5c68c43727b67a475c32afb
Opcode Fuzzy Hash: d8f0f024ec1c2f8d129628851dbafc74fb2deea2163d2281a73e4302571c3538
Instruction Fuzzy Hash: 4B21E0B5900209DFDB10CFA9D584ADEBBF5FB48320F14841AE959A7350D378AA54CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00B69B08, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B6A1B1,00000800,00000000,00000000), ref: 00B6A3C2

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 024721d7a8c30ecec499e3527b9362fb97e57e517bd66541ff1a6c84dfb963f9
Instruction ID: dad243c2c76ce2dc737f5e5986345927fce13bcb17829e9221c95304a7b11ce1
Opcode Fuzzy Hash: 024721d7a8c30ecec499e3527b9362fb97e57e517bd66541ff1a6c84dfb963f9
Instruction Fuzzy Hash: 491103B69003099FDB10CF9AC444A9EFBF4EB88314F14846AD516B7300C378A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B6A353, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B6A1B1,00000800,00000000,00000000), ref: 00B6A3C2

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af8e7600fef8dd6a5b711f5faeaefca514006e3fba5e0283c663586ea24d7ddf
Instruction ID: eb626a28013440dfcf632d54d1ab25a646ab1abfe6eb885f141d5a773ec52b94
Opcode Fuzzy Hash: af8e7600fef8dd6a5b711f5faeaefca514006e3fba5e0283c663586ea24d7ddf
Instruction Fuzzy Hash: C811E4B6D00209CFDB10CF9AD444ADEFBF5EB98324F14842AD419A7750C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B6A0D0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B6A136

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b6cfd22719fec1ce6b06a834c26c1906df89660ae5354147b7140893edcff307
Instruction ID: 5a2cec2ccc185b837ba94c2b0c1a8a286865ed06aa46e83b39803b147f0843a4
Opcode Fuzzy Hash: b6cfd22719fec1ce6b06a834c26c1906df89660ae5354147b7140893edcff307
Instruction Fuzzy Hash: DE11D2B6D006498FCB10DF9AC444ADEFBF4EB89324F14845AD429B7600D379A545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 04D60A18, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 04D60A75

Memory Dump Source

Source File: 00000000.00000002.702277270.0000000004D60000.00000040.00000001.sdmp, Offset: 04D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2001ceccf135544cc9c03758e2cc105f1dcb08f19b186a1c5f9dd55f967b5832
Instruction ID: 30276bf766f26371cc51905189af74dc3f0130c0d9a4aac93b1c6d7e7442dfbf
Opcode Fuzzy Hash: 2001ceccf135544cc9c03758e2cc105f1dcb08f19b186a1c5f9dd55f967b5832
Instruction Fuzzy Hash: 9011D0B59002499FDB10DF9AD484BDEFBF8EB88324F10851AD955A7740C378A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003C6AB9, Relevance: 1.1, Instructions: 1084COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.696087469.00000000003C2000.00000002.00020000.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.696078646.00000000003C0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b300ffdc025c5d5178c359ac99c6330fa7ad9eed6b2af60cfbb818ebdeb797a
Instruction ID: e2428d716ffdfde7a1b873ac5a710f07b7cfee3ccac30df0e98214a910d02f83
Opcode Fuzzy Hash: 7b300ffdc025c5d5178c359ac99c6330fa7ad9eed6b2af60cfbb818ebdeb797a
Instruction Fuzzy Hash: 0FA2DF6144E7C19FC7438B748CAA6817FB0AE1322471E85EBC4C5CF5B3D269684ADB63

Uniqueness

Uniqueness Score: -1.00%

Function 00B6EDD8, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0967f07a3ce38f5a52e3480a24c5ab8aa70799ddab446d7c191031eb60b018
Instruction ID: 09579fed0d5f06b0216b8a9af0afad7ef1eb6fdddb6df28554567431c4302cd4
Opcode Fuzzy Hash: 8b0967f07a3ce38f5a52e3480a24c5ab8aa70799ddab446d7c191031eb60b018
Instruction Fuzzy Hash: 3A1292B1611B469BD310CF65EC983AD3BA1B74632DB90C308D2612FAF1D7B8194AEF54

Uniqueness

Uniqueness Score: -1.00%

Function 00B6C994, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339fc5b3f45152fac373f3c03009df339b568eb80eaa4acd57c84b0d39e8d9b6
Instruction ID: e385cc82b2ac3d65f3124c246f3f5686c8d27f6957f57c9fced7b3a34b567dea
Opcode Fuzzy Hash: 339fc5b3f45152fac373f3c03009df339b568eb80eaa4acd57c84b0d39e8d9b6
Instruction Fuzzy Hash: 97A15B36E00219CFCF05DFA5C8445AEBBF2FF85304B1585AAE915AB225EB79E905CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B6EDC9, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.696772530.0000000000B60000.00000040.00000001.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add5c2a3b8aa8fdc3b603227c3c7a177a9e56415fa605635c81250072db3c5c2
Instruction ID: 0f6035f58632b28ba17e4373445fe91fb60c07a8ffb641b82877414c09639a28
Opcode Fuzzy Hash: add5c2a3b8aa8fdc3b603227c3c7a177a9e56415fa605635c81250072db3c5c2
Instruction Fuzzy Hash: 4DC1F5B1A11B468BD710CF65EC9839D7B71BB8632CF518308D2612BAE1D7B8184ADF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 3112 Parent PID: 7120 PO# 6100003560, items 00090 and 00100.exeCOMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	170
Total number of Limit Nodes:	17

Executed Functions

Function 00FDBFA8, Relevance: 4.0, APIs: 2, Instructions: 1011COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fbeae5f00d18ad878687f5a941c08b5354dc9d4389c05a9b9ab809d54710bd
Instruction ID: 339ae55d50416519362e6ac3d61fd70cff962ad7e3d51bb15b0d720dcd39b0f8
Opcode Fuzzy Hash: 62fbeae5f00d18ad878687f5a941c08b5354dc9d4389c05a9b9ab809d54710bd
Instruction Fuzzy Hash: BE82EE30B042068FCB15EBB4D4586AE7BF3AF85304F2984AAD449DB3A5DB35DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDCF70, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FDCFCF

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2553744e373d52a78f34bc19bfc586ac4de20b71dd5566d1ef2e3af852794795
Instruction ID: b043275cb8caeef3f8d79dd6ca77d8c6c6dc766facebffe15f4a5bac445a0ceb
Opcode Fuzzy Hash: 2553744e373d52a78f34bc19bfc586ac4de20b71dd5566d1ef2e3af852794795
Instruction Fuzzy Hash: C551C331B102059BCB14EBB4C855AEEB7BABF84304F14856EE4169B394DF74EC05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D6903, Relevance: 6.1, APIs: 4, Instructions: 143
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014D69A0
GetCurrentThread.KERNEL32 ref: 014D69DD
GetCurrentProcess.KERNEL32 ref: 014D6A1A
GetCurrentThreadId.KERNEL32 ref: 014D6A73

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b1077b02c4e7e8127722e30e06a8c7b2f6727a02ab2afe343b4ac813218eef79
Instruction ID: 77feec92f52694c0393504f88be9b570c92ba88c5b1de6e45bc890c6e04b34a9
Opcode Fuzzy Hash: b1077b02c4e7e8127722e30e06a8c7b2f6727a02ab2afe343b4ac813218eef79
Instruction Fuzzy Hash: F85178B09042458FEB04CFA9D998BDEBFF1EF49304F25885AE149A7361D7745884CB62

Uniqueness

Uniqueness Score: -1.00%

Function 014D6940, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014D69A0
GetCurrentThread.KERNEL32 ref: 014D69DD
GetCurrentProcess.KERNEL32 ref: 014D6A1A
GetCurrentThreadId.KERNEL32 ref: 014D6A73

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 451ae2d3ed4cbc10bed21354db3c90158f61296adabe36052245012356857c26
Instruction ID: d99a0af8e6a5b12366edf23fac57ae9bec0e83202a2ade712c72ab04af3c1c73
Opcode Fuzzy Hash: 451ae2d3ed4cbc10bed21354db3c90158f61296adabe36052245012356857c26
Instruction Fuzzy Hash: 495156B0D002498FDB14CFAAD548BDEBBF1EF88314F21845AE159A7360DB749844CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0040, Relevance: 3.5, APIs: 2, Instructions: 482
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb61a489ad2a41b8c87d499683f3f14e8500d59a9a356651a46aa5bfd50d4a0
Instruction ID: 7b83c7358b78715fd2b62f5ccbb0a2cb76bb357e9a2434ad18359bb3029ae5a7
Opcode Fuzzy Hash: 8bb61a489ad2a41b8c87d499683f3f14e8500d59a9a356651a46aa5bfd50d4a0
Instruction Fuzzy Hash: 8F029A31B042058FCB15EBB4D4586AEBBF2AF85314F14856AD819DB3A5DF34DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0F01, Relevance: 3.1, APIs: 2, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD0FE8
BasepGetExeArchType.KERNEL32 ref: 00FD1026

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 4ec867ce760d21ad10aaff8dfe022d346a410126c05b440cc35ff28891e353cb
Instruction ID: 415a72e4801d0f61d0f435894bf8c991598469ed164b12a348209107101f809d
Opcode Fuzzy Hash: 4ec867ce760d21ad10aaff8dfe022d346a410126c05b440cc35ff28891e353cb
Instruction Fuzzy Hash: CB418530B043458FD752DB78D8556AE7BF2AF89200B15C4ABD489DB356EB34DC068B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD151, Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDD238
BasepGetExeArchType.KERNEL32 ref: 00FDD276

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: d253d2291208c7ff062d1616ca7987ac80e947f61a516b28b0b7df9fac6faeee
Instruction ID: 1f31c9cde4b159adcf2ed39f4baf67b843f8afe37e91059842dca9911b85255e
Opcode Fuzzy Hash: d253d2291208c7ff062d1616ca7987ac80e947f61a516b28b0b7df9fac6faeee
Instruction Fuzzy Hash: 6641A271B043458FDB41EBB8C8506AE7BF2AF89304F1984ABD449DB756EA349C068B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1070, Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1108
BasepGetExeArchType.KERNEL32 ref: 00FD1146

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: ee56e5dfa0f9bd92c0b6ce7169913e33edccefc68268fa5a0148aed1677fe021
Instruction ID: 58b6fa006aa1594062151268eacd97e7165c13592ec2f7334d793013f50e8ad8
Opcode Fuzzy Hash: ee56e5dfa0f9bd92c0b6ce7169913e33edccefc68268fa5a0148aed1677fe021
Instruction Fuzzy Hash: 4F31E630B043599FC741EBB8C855AAE7BF2BF89300B1480AAD549DB355EB349C02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD12B1, Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1348
BasepGetExeArchType.KERNEL32 ref: 00FD1386

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 87282d9c5effec0b495037bf4dc1f15be702430c39bed9f3b81df5524462cbe3
Instruction ID: bf99363f387deebaebcd8246270a2c8acbb6bc4bb6a943581d4f3d583b94b2fa
Opcode Fuzzy Hash: 87282d9c5effec0b495037bf4dc1f15be702430c39bed9f3b81df5524462cbe3
Instruction Fuzzy Hash: 55218330B042469FCB45EBB8C855AEE7BF2AB89310B1585BAD149DB355EB349C028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1191, Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1228
BasepGetExeArchType.KERNEL32 ref: 00FD1266

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: fa74d49cdee0ea5abbfb8eb2c153f376b1606d4f5f22e76063523179af7b3ab0
Instruction ID: 9ba032ecb5443e4928f5d8d01eae94ca691517595068b630a74bdfba999aef20
Opcode Fuzzy Hash: fa74d49cdee0ea5abbfb8eb2c153f376b1606d4f5f22e76063523179af7b3ab0
Instruction Fuzzy Hash: 4921E530B082498FCB41E7B8C854AAE7BF2AB89304B15C4AAD549D7795EB34AC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDB84, Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDDBC8
BasepGetExeArchType.KERNEL32 ref: 00FDDC06

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 01d3042d3c4fb9e7d3c0f4e5e1cb712582e56fef7de83cf4414616770ba415f3
Instruction ID: 4bfb3bc8d449652ac0c047ce6304ea25a53b12d1f0676c3e67f2e75898d4a5d7
Opcode Fuzzy Hash: 01d3042d3c4fb9e7d3c0f4e5e1cb712582e56fef7de83cf4414616770ba415f3
Instruction Fuzzy Hash: D4117371F001198FCB80EBBCC8559AEB7F2BFC8200754846AD549E7354EF349D128B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD10D0, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1108
BasepGetExeArchType.KERNEL32 ref: 00FD1146

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 6ad1731b6596066431b4c7d37251647eff0165391b4cc3d3ee277bb0596787ec
Instruction ID: 912683c62b4fced6e058185e8a4f6c2b9116de6f6a6ecfe8481ae9d3018c01e3
Opcode Fuzzy Hash: 6ad1731b6596066431b4c7d37251647eff0165391b4cc3d3ee277bb0596787ec
Instruction Fuzzy Hash: 10113031B0011A9F8B84EBBDC8559AF77F6FB886107508429D549E7314EF34AD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD11F0, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1228
BasepGetExeArchType.KERNEL32 ref: 00FD1266

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: eec726d1e0c3de92d1d4ace86733241bc5935a91392543d341f6556c65a29cdf
Instruction ID: 3eba29311d815f8e8668c42b3c600b6862202ed1b6d81836e774609c7f6b4ed3
Opcode Fuzzy Hash: eec726d1e0c3de92d1d4ace86733241bc5935a91392543d341f6556c65a29cdf
Instruction Fuzzy Hash: FD111E31F001199FCB80EBBDD8549AE7BF6FBC8614B508469D549E7354EF34AD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD200, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDD238
BasepGetExeArchType.KERNEL32 ref: 00FDD276

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 5909ab308d8f944f75520b730a116966634b97a8ab21dec05b71a234edf94347
Instruction ID: 70ab15a894d2eb4b09a04393003cbb8872cf6bedecc1c5c2f3e3ba0bad611a8b
Opcode Fuzzy Hash: 5909ab308d8f944f75520b730a116966634b97a8ab21dec05b71a234edf94347
Instruction Fuzzy Hash: 1A115E31B0011A9F8B80EBBCC854AAE77F6FF88250B508469D549E7318EF34AD168B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDB90, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDDBC8
BasepGetExeArchType.KERNEL32 ref: 00FDDC06

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 1bb302bd0b1a0f4a569e152c3badf3a63df4448181c3b22e842e3c3a3d82a983
Instruction ID: 3ce3971cfe11c9d195abe4c3605a93c61126ba4eba53860fce5d1c5e04830bf0
Opcode Fuzzy Hash: 1bb302bd0b1a0f4a569e152c3badf3a63df4448181c3b22e842e3c3a3d82a983
Instruction Fuzzy Hash: 3D115E31F001198F8B80EBBCC8549AEB7F6FBC8210B50842AD549E7354EF34AD028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1310, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1348
BasepGetExeArchType.KERNEL32 ref: 00FD1386

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 609200489da9e4023d9a8f463ee59e4d99885fc3d51a86f59d0ce589dd4693e4
Instruction ID: a9fb0c6f143f275ca5463bb7d1ae6bdad5001ef470d9ba45b5f35496484de262
Opcode Fuzzy Hash: 609200489da9e4023d9a8f463ee59e4d99885fc3d51a86f59d0ce589dd4693e4
Instruction Fuzzy Hash: DB115B31F001199F8B80EBBCC8549AE7BF6FBC8210B508469D54AE7354EF34AD028F91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDCC88, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDCCC0
BasepGetExeArchType.KERNEL32 ref: 00FDCCFE

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: f74444a154ea39f3e291a130d80e5657c5e2641013a01b46fb14f50fa4274b25
Instruction ID: 64abd15eb2ed6a636f76971ac29d11667c37616c97f0d439689fb95e6746c82b
Opcode Fuzzy Hash: f74444a154ea39f3e291a130d80e5657c5e2641013a01b46fb14f50fa4274b25
Instruction Fuzzy Hash: 7B115231B105198FCB80EBBCC8549AEB7F6FB88214B508529D549E7314EF34AD128B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0618, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD0650
BasepGetExeArchType.KERNEL32 ref: 00FD068E

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 620fe931267c28acbc674831049f2089178693fa338f73fa694d16aa24f7d6dc
Instruction ID: ab42cd15dc09369c1bfa7bac0639661e440a9d3993360b41b47830c05a32d2e2
Opcode Fuzzy Hash: 620fe931267c28acbc674831049f2089178693fa338f73fa694d16aa24f7d6dc
Instruction Fuzzy Hash: C2115231B001199F8B80EBBCD8549EE7BF6FBC8210B54C529D549E7354EF34AD128B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0FB0, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD0FE8
BasepGetExeArchType.KERNEL32 ref: 00FD1026

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: bd75518f88ab9ed9c0fec09ab31ed38169b937bb6a3dcfe7003028d6744bb35b
Instruction ID: fecb509bc6f2caa9abce9284a01fe7b13f949c67c2429a924939cf1f7108105d
Opcode Fuzzy Hash: bd75518f88ab9ed9c0fec09ab31ed38169b937bb6a3dcfe7003028d6744bb35b
Instruction Fuzzy Hash: 1C115231B002198F8B80EBBCD854AAE77F6FF88210B50C429D549E7314EF34AD128F91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDCEC1, Relevance: 1.7, APIs: 1, Instructions: 194libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FDCFCF

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf6160425d07bfe4437751f207301df67e6879a156236a906b1c5d8c63a9fc26
Instruction ID: ae9d6a085e059267cfead1566827630cff69e64c629dabda5aad6781bf2c347f
Opcode Fuzzy Hash: bf6160425d07bfe4437751f207301df67e6879a156236a906b1c5d8c63a9fc26
Instruction Fuzzy Hash: 2561E131B043059FCB04EB74C854AAE7BB6AF85304F1885AAE046DB395DF74DC09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 014D500F, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845b5edae81addcd875db8038a998ed0737aed9d8a47e7c12016f31f9d79c474
Instruction ID: 7c09f002d407018c7976c787e08fe8a3a15b7ccccd0a487867abf2ca519ebcd0
Opcode Fuzzy Hash: 845b5edae81addcd875db8038a998ed0737aed9d8a47e7c12016f31f9d79c474
Instruction Fuzzy Hash: C26132B1C04249AFDF12CFA9C8A0ACEBFB1FF49310F15815AE908AB221D7759856CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014DD7C0, Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32 ref: 014DD90C

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 2ece5220a4a5c34dff5c20399a068abf5be264ce27fba75ed575e34b5614e043
Instruction ID: 338f108e3e77acdc3f4c2d9da0c8249d19362348ac335709617f15de64edc428
Opcode Fuzzy Hash: 2ece5220a4a5c34dff5c20399a068abf5be264ce27fba75ed575e34b5614e043
Instruction Fuzzy Hash: FD412531F083554FEF1A46E948B537B7ABA9B85210F09447BE91ADB3E2EB74CC058352

Uniqueness

Uniqueness Score: -1.00%

Function 014DA323, Relevance: 1.6, APIs: 1, Instructions: 123threadCOMMON

Download Yara Rule

APIs

CreateThreadpoolIo.KERNEL32 ref: 014DA49E

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CreateThreadpool
String ID:
API String ID: 3648228295-0
Opcode ID: b981e85f9737e59acb1eb5c69a95a42e055222f76488886cf5331945c211aa5b
Instruction ID: ee3c21586b8bf81d97bf7c50345df0264c3b564e45d9535ec142608020a7c5c3
Opcode Fuzzy Hash: b981e85f9737e59acb1eb5c69a95a42e055222f76488886cf5331945c211aa5b
Instruction Fuzzy Hash: 764190356042059FEF06AF68D8657AE3BA7FB85304F14802AFA098B361DB75DC168B91

Uniqueness

Uniqueness Score: -1.00%

Function 014D5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 014D51A2

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e85fadc14a8b80c8f71c4717a8c343b83b973432487e7a6914970daf7ba26a8a
Instruction ID: e0400bc1ff206d5c71df2aeb2be9fd7f57b41eed8993efc2739153c8618ebe97
Opcode Fuzzy Hash: e85fadc14a8b80c8f71c4717a8c343b83b973432487e7a6914970daf7ba26a8a
Instruction Fuzzy Hash: 8B41B0B1D103099FDF14CFAAC894ADEBBB5FF48314F64812AE819AB210DB749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014D7780, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 014D7F09

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c5f2907c07e96e84ff0a133a978eba2892efa9f5d6b575c08ae813c8a155b5bb
Instruction ID: bcb20fd032074719aa1fbbd9ca2e097ea2fef51d02bc1d81d5f2fcfba429107e
Opcode Fuzzy Hash: c5f2907c07e96e84ff0a133a978eba2892efa9f5d6b575c08ae813c8a155b5bb
Instruction Fuzzy Hash: B9413BB4A00305CFCB14CF59C458AABBBF5FF88318F158499E519A7321D774A941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DC109, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 014DC192

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 09171966b0965e065e500b88f898f7055cf7d688a4b6e7cfd5762bc411889797
Instruction ID: c8d690c083d20f66ee9dc3ce520b004a10d78705180322f331a960908c9c6498
Opcode Fuzzy Hash: 09171966b0965e065e500b88f898f7055cf7d688a4b6e7cfd5762bc411889797
Instruction Fuzzy Hash: A931C0B58003498FEB21CFA9E59979EBFF4EB06304F14845ED484EB242C7785949CF61

Uniqueness

Uniqueness Score: -1.00%

Function 014D6B61, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014D6BEF

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1bf36c2b9a1b6ee7a9159d526b6eb0193fcbff21532b5ee60f98c98e2a7e3b49
Instruction ID: 9c766d8fbd524082c5c48359cee60a92c3992610aa1754d1bf6f4fad56b167c0
Opcode Fuzzy Hash: 1bf36c2b9a1b6ee7a9159d526b6eb0193fcbff21532b5ee60f98c98e2a7e3b49
Instruction Fuzzy Hash: CE2112B59002499FDF10CFAAD484AEEBFF4EB48320F15841AE914A3310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014D6BEF

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 334c86a2550a5f7ecc50121375cce365f932579311a5a648fe36b11c011b77b7
Instruction ID: 61d51426689158493e8aedd391e0256faa818a2c9f77f63c8a9415b6714d468c
Opcode Fuzzy Hash: 334c86a2550a5f7ecc50121375cce365f932579311a5a648fe36b11c011b77b7
Instruction Fuzzy Hash: 9321E2B59002089FDB10CFAAD984ADEFBF8EB48324F15841AE914A3310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014DC118, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 014DC192

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: f5a12a9780d6e841cfd2e567dcee83c028569e2011a76f0fbf424d9ff859018b
Instruction ID: 3f05545dbc0789374d751de0a14b91092ec9a740a242920dde1358fb8892de21
Opcode Fuzzy Hash: f5a12a9780d6e841cfd2e567dcee83c028569e2011a76f0fbf424d9ff859018b
Instruction Fuzzy Hash: 1F11597190030A8FDF20DFA9C58979EBBF8EB49714F10882ED445A7641CB796905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D32D8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014D4116

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 03a7880fb8be72dea00a118d75f98b716eb530cdd9a5e8479ed5a6d6a5fd4294
Instruction ID: cc320aeba7121f8bf67159b9ac205cba6014a47101a452844ee2bd60c2cc8fad
Opcode Fuzzy Hash: 03a7880fb8be72dea00a118d75f98b716eb530cdd9a5e8479ed5a6d6a5fd4294
Instruction Fuzzy Hash: 5911F0B19006498BDB10DFAAC448BDEFBF4EB89224F15842AD929A7710D374A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014D40AC, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014D4116

Memory Dump Source

Source File: 00000008.00000002.932252850.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14d0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d378e370f8118e4ac6061e466e1d9c9bde3d50534372be2beb9b9e8f973a1f8f
Instruction ID: 06aa9539180aa8c8c51affa5b8cb9391e56fd0f62806c4b99903452a98b6012a
Opcode Fuzzy Hash: d378e370f8118e4ac6061e466e1d9c9bde3d50534372be2beb9b9e8f973a1f8f
Instruction Fuzzy Hash: 191102B6D006098FDB10CFAAC484BDEFBF4EF48214F15841AC529A7610C378A54ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD100F, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1026

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: a3f909d7c2af8e3e70c0c0201f7be5416944b7bb3ca96546ef98ec59fb7d75ca
Instruction ID: fc93624d326b6780ec31a43fb79444b34fb0d2493beb90910789e1576cec0393
Opcode Fuzzy Hash: a3f909d7c2af8e3e70c0c0201f7be5416944b7bb3ca96546ef98ec59fb7d75ca
Instruction Fuzzy Hash: 4EE0ED36B0011ACBCF40FBB9D8595DD73F2BF98214B10806AD50AE7364DE34AD118B61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD112F, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1146

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 69f2457ae8d1d3976fc03db1d0f51716743c1a0636c51ec129420d8b325fbb25
Instruction ID: a12266ca618ec38f91972b98c08be1ad6b1ec541cf11b6ff99150c91de838228
Opcode Fuzzy Hash: 69f2457ae8d1d3976fc03db1d0f51716743c1a0636c51ec129420d8b325fbb25
Instruction Fuzzy Hash: E5E0ED35B0011A9BCF44FBB9D8599DE73F2BF98215B108069D50AE7364DE34AD118BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDD25F, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDD276

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 1fe872177eada36bb908e9c59b10f6acaa21ae74eaa35f41ad5807dd76372f49
Instruction ID: 7b08d763baf815300733041956770e8dcad39bd2a0cea9477a8b90c101db26f6
Opcode Fuzzy Hash: 1fe872177eada36bb908e9c59b10f6acaa21ae74eaa35f41ad5807dd76372f49
Instruction Fuzzy Hash: A2E06D35B0001A8BCF40FBB8D8549DD73F2BF98215B008069D50AE3364DE34AC118B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD124F, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1266

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 2968c7c23b0183997a34cb8fcfd9d5d274ef8c1e07c5d0f0bc5ccbabe1250c1e
Instruction ID: 7818260d611d3040e4b7dfcfba9b0b4613f82d80f545960451e5985b69a955e5
Opcode Fuzzy Hash: 2968c7c23b0183997a34cb8fcfd9d5d274ef8c1e07c5d0f0bc5ccbabe1250c1e
Instruction Fuzzy Hash: C9E0ED35B100198BCF40FBB9D8599DD77F2BB98215B108069D50AE7364DE34AD118B61

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDBEF, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDDC06

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: cfc07204cb28175f5e59810bbafd2b5a3d6d266d67bac3428d926281f384412d
Instruction ID: 3ae669b3d2a1624f28a77671bc594230781a6978a26e167cd368030e6d904e95
Opcode Fuzzy Hash: cfc07204cb28175f5e59810bbafd2b5a3d6d266d67bac3428d926281f384412d
Instruction Fuzzy Hash: E2E0ED35B104198FCF44FBB9D8559DDB3F2BB98215B10806AD50AE7364DE34AC118B61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD136F, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD1386

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: c250cf0318d6f347dde5dd65ae7d3df8c04e0b688c2d6290e064f4ad3057f26d
Instruction ID: cf6a4ac74e4fe736bd05d9ef25b350a3589af079a7af6ebadb95a1e70222119e
Opcode Fuzzy Hash: c250cf0318d6f347dde5dd65ae7d3df8c04e0b688c2d6290e064f4ad3057f26d
Instruction Fuzzy Hash: 19E01235B000198BCF44FBB9D8549ED73F2FFD8215B148069D50AE7364DE34AC128B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FDCCE7, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FDCCFE

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: a16b2998cd7970bbec7b03b9fb94dd9589eac440cc587a88298cbd30d5297b15
Instruction ID: 0be3e9f83677d8e26523bb7c0789a36a39b2f3f50d6383d1c49522247fe63d79
Opcode Fuzzy Hash: a16b2998cd7970bbec7b03b9fb94dd9589eac440cc587a88298cbd30d5297b15
Instruction Fuzzy Hash: D4E0ED36B1041A8BCF40FBB9D8549DDB7F2FB98218B10806AD50AE7364DE34AD128B61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0677, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BasepGetExeArchType.KERNEL32 ref: 00FD068E

Memory Dump Source

Source File: 00000008.00000002.931634547.0000000000FD0000.00000040.00000010.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_fd0000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID: ArchBasepType
String ID:
API String ID: 838778181-0
Opcode ID: 18a7bc4d5eddc7254f0b666d3a4760ef425c22d5c0328af7b5beb94faabd3496
Instruction ID: 5a9a4f73092d2a7cb94a6c391a44a5e0be3049a63453365d63807debfb1e2531
Opcode Fuzzy Hash: 18a7bc4d5eddc7254f0b666d3a4760ef425c22d5c0328af7b5beb94faabd3496
Instruction Fuzzy Hash: EBE0ED36B000198BCF40FBB9D8559ED77F2EB98214B14816AD50AE7364DE34AD118B51

Uniqueness

Uniqueness Score: -1.00%

Function 0136D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.932106712.000000000136D000.00000040.00000001.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_136d000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fbe951208b28e2118cd65aae5d86fafb5b38e5530d9355181c2d7574cffe45
Instruction ID: b45916aab459dc8716d2363c977fe79b4e78f132f416a4b23da3654005682e03
Opcode Fuzzy Hash: e2fbe951208b28e2118cd65aae5d86fafb5b38e5530d9355181c2d7574cffe45
Instruction Fuzzy Hash: 6E213775604244DFCB15CF54D8C4B16BB6DFB88358F24C969D8894B34AC33BD857CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.932106712.000000000136D000.00000040.00000001.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_136d000_PO# 6100003560, items 00090 and 00100.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
Instruction ID: 47d5edb198b729416d5c5121869c62fa305a9f535ce7b1b0ee95121be51298a3
Opcode Fuzzy Hash: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
Instruction Fuzzy Hash: F0118E75504280DFDB12CF54D5C4B15BFB1FB84318F24C6AAD8494B65AC33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilename vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.702898417.0000000006E00000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.697012904.0000000002701000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameOhdryIYKwtfOhFKUvICmEItYgptrtNr.exe4 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameOhdryIYKwtfOhFKUvICmEItYgptrtNr.exe4 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.698577528.0000000003709000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000000.00000002.696087469.00000000003C2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilename vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000004.00000000.684019444.00000000002E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilename vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000006.00000000.687471583.0000000000222000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilename vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000007.00000000.689037100.00000000000A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilename vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000000.691670315.0000000000B12000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.931375320.0000000000438000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameOhdryIYKwtfOhFKUvICmEItYgptrtNr.exe4 vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe, 00000008.00000002.931555930.0000000000F38000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO# 6100003560, items 00090 and 00100.exe
Source: PO# 6100003560, items 00090 and 00100.exe	Binary or memory string: OriginalFilenameConstructorReturnMessa.exe0 vs PO# 6100003560, items 00090 and 00100.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PO# 6100003560, items 00090 and 00100.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: PO# 6100003560, items 00090 and 00100.exe PID: 7120 Parent PID: 1496

General

Function 00B69EF0, Relevance: 1.7, APIs: 1, Instructions: 188
COMMON

Function 04D607D0, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 04D607CF, Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00B63E30, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00B6556F, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 04D62D90, Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 00B69E90, Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 00B6C111, Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 014D6903, Relevance: 6.1, APIs: 4, Instructions: 143
threadCOMMON

Function 014D6940, Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00FD0040, Relevance: 3.5, APIs: 2, Instructions: 482
COMMON

Function 00FD0F01, Relevance: 3.1, APIs: 2, Instructions: 115
COMMON

Function 00FDD151, Relevance: 3.1, APIs: 2, Instructions: 110
COMMON

Function 00FD1070, Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Function 00FD12B1, Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Function 00FD1191, Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Function 00FDDB84, Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Function 00FD10D0, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON