Edit tour

Windows Analysis Report
2C01EPgbbjrSPr7.exe

Overview

General Information

Sample Name:	2C01EPgbbjrSPr7.exe
Analysis ID:	626545
MD5:	dc6c55fee2366dee1d9c502bf061a8dc
SHA1:	609b99bc51ea6e1512d4aa1636a4586d2f6b29d6
SHA256:	99c52b9d5bcaa8af4bae268f70a39b94c0b2879dfed2cbdabd25c6fef5ff2258
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Yara detected Generic Downloader

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SGDT)

Classification

Process Tree

System is w10x64

2C01EPgbbjrSPr7.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe" MD5: DC6C55FEE2366DEE1D9C502BF061A8DC)

RegSvcs.exe (PID: 6108 cmdline: {path} MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "leakkim@dtvcambodia.com", "Password": "@DTVcambodia2017", "Host": "mail.dtvcambodia.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30a74:$s10: logins 0x30da70:$s11: credential 0x1e7f:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x29c3:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x1cf7:$m4: %startupfolder%\%insfolder%\%insname%/\%insfolder%\Software\Microsoft\Windows\CurrentVersion\Run%insregname%SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunTruehttp 0x1fa0:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
Process Memory Space: 2C01EPgbbjrSPr7.exe PID: 6992	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 2C01EPgbbjrSPr7.exe PID: 6992	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 6108	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6108	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1f728:$s1: get_kbok 0x3afe0:$s1: get_kbok 0x1ffa8:$s2: get_CHoo 0x3b860:$s2: get_CHoo 0x20b5b:$s3: set_passwordIsSet 0x3c413:$s3: set_passwordIsSet 0x1f5d4:$s4: get_enableLog 0x3ae8c:$s4: get_enableLog 0x1ea46:$g1: get_Clipboard 0x3a2fe:$g1: get_Clipboard 0x1ea54:$g2: get_Keyboard 0x3a30c:$g2: get_Keyboard 0x1ea61:$g3: get_Password 0x3a319:$g3: get_Password 0x1fe82:$g4: get_CtrlKeyDown 0x3b73a:$g4: get_CtrlKeyDown 0x1fe92:$g5: get_ShiftKeyDown 0x3b74a:$g5: get_ShiftKeyDown 0x1fea3:$g6: get_AltKeyDown 0x3b75b:$g6: get_AltKeyDown 0x7522:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
4.0.RegSvcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.RegSvcs.exe.400000.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
4.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2efc2:$s1: get_kbok 0x2f8f6:$s2: get_CHoo 0x30569:$s3: set_passwordIsSet 0x2edc6:$s4: get_enableLog 0x3349a:$s8: torbrowser 0x31e76:$s10: logins 0x317f5:$s11: credential 0x2e1bb:$g1: get_Clipboard 0x2e1c9:$g2: get_Keyboard 0x2e1d6:$g3: get_Password 0x2f7a4:$g4: get_CtrlKeyDown 0x2f7b4:$g5: get_ShiftKeyDown 0x2f7c5:$g6: get_AltKeyDown
4.0.RegSvcs.exe.400000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.3.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.RegSvcs.exe.400000.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
4.0.RegSvcs.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.RegSvcs.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
4.0.RegSvcs.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.RegSvcs.exe.400000.2.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.RegSvcs.exe.400000.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x33c76:$s10: logins 0x335f5:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown 0x315b4:$g5: get_ShiftKeyDown 0x315c5:$g6: get_AltKeyDown
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30dc2:$s1: get_kbok 0x66de2:$s1: get_kbok 0x316f6:$s2: get_CHoo 0x67716:$s2: get_CHoo 0x32369:$s3: set_passwordIsSet 0x68389:$s3: set_passwordIsSet 0x30bc6:$s4: get_enableLog 0x66be6:$s4: get_enableLog 0x3529a:$s8: torbrowser 0x6b2ba:$s8: torbrowser 0x33c76:$s10: logins 0x69c96:$s10: logins 0x335f5:$s11: credential 0x69615:$s11: credential 0x2ffbb:$g1: get_Clipboard 0x65fdb:$g1: get_Clipboard 0x2ffc9:$g2: get_Keyboard 0x65fe9:$g2: get_Keyboard 0x2ffd6:$g3: get_Password 0x65ff6:$g3: get_Password 0x315a4:$g4: get_CtrlKeyDown
Click to see the 26 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.RegSvcs.exe.400000.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "leakkim@dtvcambodia.com", "Password": "@DTVcambodia2017", "Host": "mail.dtvcambodia.com"}

Multi AV Scanner detection for submitted file

Source: 2C01EPgbbjrSPr7.exe	Virustotal: Detection: 32%			Perma Link
Source: 2C01EPgbbjrSPr7.exe	ReversingLabs: Detection: 61%

Machine Learning detection for sample

Source: 2C01EPgbbjrSPr7.exe

Joe Sandbox ML: detected

Source: 4.0.RegSvcs.exe.400000.2.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.RegSvcs.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.RegSvcs.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.RegSvcs.exe.400000.3.unpack	Avira: Label: TR/Spy.Gen8

Source: 2C01EPgbbjrSPr7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 2C01EPgbbjrSPr7.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_02DADFF0

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

IP Address: 192.185.162.134 192.185.162.134

Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/Sl
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513181926.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a95e9caafddea
Source: RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/sk
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a95e9caafd
Source: RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dtvcambodia.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243510111.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eolgGu.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.dtvcambodia.com
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0F
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.253625429.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com7
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaI)
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comceTF
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcom7
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcomI)
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgreta
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.252302756.0000000005E78000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comkP)
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsiv
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comtud
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244124001.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243951668.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244065913.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comW
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comcI
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243951668.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comx
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246378606.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/:
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn4
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn7
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnicre2
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.243716394.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243840965.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243810275.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243764153.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243882011.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243743765.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.245662763.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krC
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.245662763.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kre
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244443790.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.244414864.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244443790.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comr
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.dephy
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/d
Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%$
Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: RegSvcs.exe, 00000004.00000002.511188968.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511337884.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511295523.0000000002EF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drm1JEWaqqI1.net
Source: RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sldl.windowsupdate.com/
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: mail.dtvcambodia.com

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen

.NET source code contains very large array initializations

Source: 4.0.RegSvcs.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012
Source: 4.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012
Source: 4.0.RegSvcs.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012
Source: 4.0.RegSvcs.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012
Source: 4.0.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012
Source: 4.0.RegSvcs.exe.400000.3.unpack, u003cPrivateImplementationDetailsu003eu007b0521C396u002dCDD4u002d4B8Fu002d8DB5u002d045B90A6C938u007d/u003197B8149u002dCA5Eu002d4A78u002dA70Au002dCE490C237E5C.cs	Large array initialization: .cctor: array initializer size 12012

Source: 2C01EPgbbjrSPr7.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA70E8	0_2_02DA70E8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DAA850	0_2_02DAA850
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA0040	0_2_02DA0040
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA2830	0_2_02DA2830
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA9E90	0_2_02DA9E90
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DAAEB8	0_2_02DAAEB8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA7AD8	0_2_02DA7AD8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA7AC8	0_2_02DA7AC8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA1AC0	0_2_02DA1AC0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA1AB0	0_2_02DA1AB0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA7B83	0_2_02DA7B83
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA23B8	0_2_02DA23B8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA33B0	0_2_02DA33B0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA23A8	0_2_02DA23A8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA3300	0_2_02DA3300
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA70D8	0_2_02DA70D8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA7808	0_2_02DA7808
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA0007	0_2_02DA0007
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DAA83F	0_2_02DAA83F
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA282B	0_2_02DA282B
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DAA1D0	0_2_02DAA1D0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DAA1CF	0_2_02DAA1CF
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA2158	0_2_02DA2158
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA2168	0_2_02DA2168
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA0EF0	0_2_02DA0EF0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA9E81	0_2_02DA9E81
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA2650	0_2_02DA2650
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA264C	0_2_02DA264C
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA0F00	0_2_02DA0F00
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA7C20	0_2_02DA7C20
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA1DD0	0_2_02DA1DD0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA75E8	0_2_02DA75E8
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA1DE0	0_2_02DA1DE0
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA8D98	0_2_02DA8D98
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA8D97	0_2_02DA8D97
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_00B52050	0_2_00B52050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E234A0	4_2_00E234A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E231A0	4_2_00E231A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E20908	4_2_00E20908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E27E30	4_2_00E27E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E28580	4_2_00E28580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00E28680	4_2_00E28680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00F647A0	4_2_00F647A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00F646B0	4_2_00F646B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00F6D660	4_2_00F6D660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED6508	4_2_05ED6508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED7120	4_2_05ED7120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED90D8	4_2_05ED90D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED6850	4_2_05ED6850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: String function: 05EDBC18 appears 48 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 98%

Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenOOTwECnjSqKtJrhjFcwUgB.exe4 vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000003.269344146.0000000003941000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000000.240821247.0000000000C1E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameg863j.exe8 vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenOOTwECnjSqKtJrhjFcwUgB.exe4 vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.289470326.0000000007A40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283195243.0000000003021000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs 2C01EPgbbjrSPr7.exe
Source: 2C01EPgbbjrSPr7.exe	Binary or memory string: OriginalFilenameg863j.exe8 vs 2C01EPgbbjrSPr7.exe

Source: 2C01EPgbbjrSPr7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2C01EPgbbjrSPr7.exe	Virustotal: Detection: 32%
Source: 2C01EPgbbjrSPr7.exe	ReversingLabs: Detection: 61%

Source: 2C01EPgbbjrSPr7.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe "C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe"
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2C01EPgbbjrSPr7.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@3/4@3/1

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: 2C01EPgbbjrSPr7.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: 2C01EPgbbjrSPr7.exe	String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: 2C01EPgbbjrSPr7.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: 2C01EPgbbjrSPr7.exe	String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: 2C01EPgbbjrSPr7.exe	String found in binary or memory: (O-aDd(

Source: 4.0.RegSvcs.exe.400000.2.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.RegSvcs.exe.400000.2.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.RegSvcs.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.RegSvcs.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.RegSvcs.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 2C01EPgbbjrSPr7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2C01EPgbbjrSPr7.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_00B576BF push es; retf	0_2_00B576D6
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_00B576A7 push es; retf	0_2_00B576BE
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DB2057 push ebx; retf	0_2_02DB2058
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DB1A97 push cs; retf	0_2_02DB1A98
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Code function: 0_2_02DA51FC push esi; ret	0_2_02DA51FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_00F6EB6C push 8405CF2Eh; iretd	4_2_00F6EB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED1DF9 push ecx; iretd	4_2_05ED1DFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05EDEDD3 push esp; ret	4_2_05EDEE19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05EDB8AB pushfd ; iretd	4_2_05EDB8B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED1BC1 push eax; iretd	4_2_05ED1BC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05ED1BC3 push eax; iretd	4_2_05ED1BCA

Source: initial sample

Static PE information: section name: .text entropy: 7.85472323726

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 2C01EPgbbjrSPr7.exe PID: 6992, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe TID: 7012

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5234			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4582			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_00F67878 sgdt fword ptr [eax]

4_2_00F67878

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: RegSvcs.exe, 00000004.00000003.506326715.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513181926.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHP
Source: RegSvcs.exe, 00000004.00000003.506326715.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513181926.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW?
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: 2C01EPgbbjrSPr7.exe, 00000000.00000002.283797713.0000000003077000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_05EDC99E QueryDosDeviceA,LoadModule,SetVolumeLabelW,LocalFlags,UnregisterWaitUntilOOBECompleted,KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,

4_2_05EDC99E

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43A000	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 960008	Jump to behavior

Modifies the hosts file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}

Jump to behavior

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4_2_05ED5594 GetUserNameW,

4_2_05ED5594

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2C01EPgbbjrSPr7.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.RegSvcs.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2C01EPgbbjrSPr7.exe.41888c8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2C01EPgbbjrSPr7.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6108, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Masquerading	2 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	141 Virtualization/Sandbox Evasion	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	211 Process Injection	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	3 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2C01EPgbbjrSPr7.exe	32%	Virustotal		Browse
2C01EPgbbjrSPr7.exe	62%	ReversingLabs	ByteCode-MSIL.Trojan.Injuke
2C01EPgbbjrSPr7.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.RegSvcs.exe.400000.2.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.RegSvcs.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.RegSvcs.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.RegSvcs.exe.400000.3.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
dtvcambodia.com	0%	Virustotal		Browse
x1.i.lencr.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.comsiv	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.c	0%	URL Reputation	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.fontbureau.comcomI)	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fonts.comcI	0%	Avira URL Cloud	safe
http://www.fontbureau.comceTF	0%	Avira URL Cloud	safe
http://www.fontbureau.comcom7	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0F	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnicre2	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
https://drm1JEWaqqI1.net	0%	Avira URL Cloud	safe
http://www.fontbureau.comtud	0%	Avira URL Cloud	safe
http://www.fontbureau.comgreta	0%	URL Reputation	safe
http://www.fontbureau.comkP)	0%	Avira URL Cloud	safe
http://www.urwpp.dephy	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://api.ipify.org%GETMozilla/5.0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fontbureau.com7	0%	Avira URL Cloud	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sandoll.co.krC	0%	Avira URL Cloud	safe
http://www.fonts.comx	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cn/:	0%	Avira URL Cloud	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://www.tiro.comr	0%	Avira URL Cloud	safe
http://www.fontbureau.comaI)	0%	Avira URL Cloud	safe
http://eolgGu.com	0%	Avira URL Cloud	safe
http://www.sandoll.co.kre	0%	URL Reputation	safe
http://dtvcambodia.com	0%	Avira URL Cloud	safe
http://www.fonts.comW	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
https://api.ipify.org%$	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn7	0%	URL Reputation	safe
http://mail.dtvcambodia.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.founder.com.cn/cn4	0%	URL Reputation	safe
http://x1.i.lencr.org/d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dtvcambodia.com	192.185.162.134	true	true	0%, Virustotal, Browse	unknown
x1.i.lencr.org	unknown	unknown	false	1%, Virustotal, Browse	unknown
mail.dtvcambodia.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comsiv	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244443790.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.c	2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comessed	2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcomI)	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.goodfont.co.kr	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comcI	2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comceTF	2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comcom7	2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0F	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnicre2	2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	2C01EPgbbjrSPr7.exe, 00000000.00000003.243716394.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243840965.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243810275.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243764153.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243882011.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243743765.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drm1JEWaqqI1.net	RegSvcs.exe, 00000004.00000002.511188968.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511337884.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511295523.0000000002EF9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comtud	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comgreta	2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comkP)	2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.252302756.0000000005E78000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.urwpp.dephy	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%GETMozilla/5.0	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://www.fonts.com	2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244124001.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243951668.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244065913.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com7	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.krC	2C01EPgbbjrSPr7.exe, 00000000.00000003.245662763.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comx	2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.243951668.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	2C01EPgbbjrSPr7.exe, 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.513029654.0000000005C2C000.00000004.00000800.00020000.00000000.sdmp, 2D85F72862B55C4EADD9E66E06947F3D0.4.dr	false	URL Reputation: safe	unknown
http://DynDns.comDynDNS	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/:	2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comF	2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cps.letsencrypt.org0	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comr	2C01EPgbbjrSPr7.exe, 00000000.00000003.244414864.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.244443790.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comaI)	2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://eolgGu.com	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kre	2C01EPgbbjrSPr7.exe, 00000000.00000003.245662763.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://dtvcambodia.com	RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.comW	2C01EPgbbjrSPr7.exe, 00000000.00000003.243999766.0000000005E8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	2C01EPgbbjrSPr7.exe, 00000000.00000003.253560396.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.253090300.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.254284053.0000000005E79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.w	2C01EPgbbjrSPr7.exe, 00000000.00000003.243510111.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%$	RegSvcs.exe, 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	2C01EPgbbjrSPr7.exe, 00000000.00000003.246378606.0000000005EAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	2C01EPgbbjrSPr7.exe, 00000000.00000003.253625429.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn7	2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.246653744.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.dtvcambodia.com	RegSvcs.exe, 00000004.00000002.511389823.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	2C01EPgbbjrSPr7.exe, 00000000.00000002.288273378.0000000005E70000.00000004.00000800.00020000.00000000.sdmp, 2C01EPgbbjrSPr7.exe, 00000000.00000003.281259255.0000000005E70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn4	2C01EPgbbjrSPr7.exe, 00000000.00000003.246407275.0000000005E74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	2C01EPgbbjrSPr7.exe, 00000000.00000002.288950173.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/d	RegSvcs.exe, 00000004.00000002.512946550.0000000005BE8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.162.134	dtvcambodia.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626545
Start date and time: 14/05/202212:06:20	2022-05-14 12:06:20 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2C01EPgbbjrSPr7.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@3/4@3/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0%) Quality average: 0% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 98% Number of executed functions: 91 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.50.97.168
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:07:31	API Interceptor	1x Sleep call for process: 2C01EPgbbjrSPr7.exe modified
12:07:49	API Interceptor	632x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
192.185.162.134	KU8Nem8AgTxeMHZ.exe	Get hash	malicious	Browse
	draft BL.xlsx	Get hash	malicious	Browse
	UHHxvMh45L6Q0PI.exe	Get hash	malicious	Browse
	Import Doc.xlsx	Get hash	malicious	Browse
	VLCo8U5XU1JbLd5.exe	Get hash	malicious	Browse
	pCGyCdiP09YjyNN.exe	Get hash	malicious	Browse
	GAjJLlt1tTmXRw3.exe	Get hash	malicious	Browse
	NnXlxZyaZUDKLcy.exe	Get hash	malicious	Browse
	block.exe	Get hash	malicious	Browse
	nunu$$.exe	Get hash	malicious	Browse
	nunu.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	https://tonymaster.com.br/php/php/secured_file.html	Get hash	malicious	Browse	192.185.31.22
	https://relaxhere.org/de/rotluseipovamaetm	Get hash	malicious	Browse	192.254.236.149
	ungewx6mWH	Get hash	malicious	Browse	98.131.204.216
	Tsunami.arm	Get hash	malicious	Browse	98.131.204.233
	faiN1qtW6V	Get hash	malicious	Browse	142.5.110.68
	U409.lnk	Get hash	malicious	Browse	192.185.131.124
	2Qhf8IMXPr	Get hash	malicious	Browse	98.131.204.200
	https://leadscrapper.com/ev/ntsiaimi	Get hash	malicious	Browse	192.254.236.149
	https://surveyatos.com	Get hash	malicious	Browse	192.185.190.187
	payment advice.exe	Get hash	malicious	Browse	142.4.0.135
	https://securepubads.g.doubleclick.net/pcs/view?adurl=https%3a%2f%2fquzqvm.codesandbox.io?dg=cHJ6ZW15c2xhdy5rcmF3Y3p5a293c2tpQG1hZXJza2RyaWxsaW5nLmNvbQ==	Get hash	malicious	Browse	192.185.78.150
	M456_ __ ___ __.exe	Get hash	malicious	Browse	142.4.0.135
	POZ1809027.bit.gz.exe	Get hash	malicious	Browse	142.4.0.135
	Falconincorporation_Form_Dt_05.12.2022.xls	Get hash	malicious	Browse	192.254.239.248
	z4ehq74vWO	Get hash	malicious	Browse	173.83.212.190
	https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://51462046981xnZKorVuKVrP.praiadofortecabofrio.com.br/aa/jkwarburton@nuskin.com	Get hash	malicious	Browse	162.241.102.156
	https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://89204186061IBowccqdtxpJ.praiadofortecabofrio.com.br/aa/fournier@saskpolytech.ca	Get hash	malicious	Browse	162.241.102.156
	9mfbEdx1Hp.exe	Get hash	malicious	Browse	192.185.174.178
	ORDER M52022.xlsx	Get hash	malicious	Browse	192.185.174.178
	x86	Get hash	malicious	Browse	162.144.117.208

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	modified
Size (bytes):	192
Entropy (8bit):	2.795995823915415
Encrypted:	false
SSDEEP:	3:kkFkle0gPQXfllXlE/zMcyzXNNX8RolJuRdyo1dlUKlGXJlDdt:kKHr1yzdNMa8Rdy+UKcXP
MD5:	D5EA50AB6E2D47C57A613BC60522B9A0
SHA1:	1E199675C0C52DE3FDCCCD2415826C7904191969
SHA-256:	11E594484545FF0179379C437CDA560836777544955144E2DBC50BDD676ED282
SHA-512:	4312819708CD78D76DF4F374ACFCC8BCFE6B8408A1D98CD47927FA3E7772BDFB24BB4B22D0450BBBDF83C689868EF399BFA37DA20A1E69725AF3C6BA5304AC0C
Malicious:	false
Reputation:	low
Preview:	p...... ........mQ...g..(....................................................... ..........~...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".5.a.6.2.8.1.5.c.-.5.6.f."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2C01EPgbbjrSPr7.exe.log

Download File

Process:	C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Reputation:	high, very likely benign file
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8493365780126645
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	2C01EPgbbjrSPr7.exe
File size:	833536
MD5:	dc6c55fee2366dee1d9c502bf061a8dc
SHA1:	609b99bc51ea6e1512d4aa1636a4586d2f6b29d6
SHA256:	99c52b9d5bcaa8af4bae268f70a39b94c0b2879dfed2cbdabd25c6fef5ff2258
SHA512:	8ca56693aabeeec0e59c1638d9097052bff8363a8f4629c3d523e46f970b4fac8e7a97b6c6c5f504c7eb63c8eb10e1b5785a5cd26b66fba562b1d1cd428e9956
SSDEEP:	12288:KaufL3YRRhPziuVIf5EKgZU4iFrqSwkVwQjylXPZmQJPEI5xnCIzjLjvllg+WKG:Kzf0H7iuVIRE9ZHo8VQ8N57dlW
TLSH:	250501153B5D3E62D5ABCB345152C00881B5FC9FBD33E12B7EA73D8E6818B5193A0AB1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$>~b..............P.............F.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4ccc46
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x627E3E24 [Fri May 13 11:16:52 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, byte ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], cl
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*2], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc dword ptr [eax+00h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xccbf4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x5a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcac74	0xcae00	False	0.900544660736	data	7.85472323726	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xce000	0x5a4	0x600	False	0.422526041667	data	4.0893027472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xce090	0x314	data
RT_MANIFEST	0xce3b4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017
Assembly Version	1.0.0.0
InternalName	g863j.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Coffee Shop
ProductVersion	1.0.0.0
FileDescription	Coffee Shop
OriginalFilename	g863j.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 12:09:18.696096897 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:18.837666988 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:18.837800026 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.225521088 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.226907015 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.368829966 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.369097948 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.513761997 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.566498995 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.643241882 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.797015905 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.797054052 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.797072887 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:19.797126055 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.816838980 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:19.959172964 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:20.003353119 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:39.908737898 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.050744057 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.052113056 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.194169044 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.194650888 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.347683907 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.348759890 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.490468025 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.490757942 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.647701979 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.647914886 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.789446115 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.790183067 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.790239096 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.791019917 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.791034937 CEST	49852	587	192.168.2.3	192.185.162.134
May 14, 2022 12:09:40.931632042 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.931677103 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.932300091 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.932327032 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.932929993 CEST	587	49852	192.185.162.134	192.168.2.3
May 14, 2022 12:09:40.973928928 CEST	49852	587	192.168.2.3	192.185.162.134

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 12:09:18.372874975 CEST	54205	53	192.168.2.3	8.8.8.8
May 14, 2022 12:09:18.523155928 CEST	53	54205	8.8.8.8	192.168.2.3
May 14, 2022 12:09:18.532202959 CEST	62756	53	192.168.2.3	8.8.8.8
May 14, 2022 12:09:18.673108101 CEST	53	62756	8.8.8.8	192.168.2.3
May 14, 2022 12:09:24.027848959 CEST	58497	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 14, 2022 12:09:18.372874975 CEST	192.168.2.3	8.8.8.8	0xc04d	Standard query (0)	mail.dtvcambodia.com	A (IP address)	IN (0x0001)
May 14, 2022 12:09:18.532202959 CEST	192.168.2.3	8.8.8.8	0xc312	Standard query (0)	mail.dtvcambodia.com	A (IP address)	IN (0x0001)
May 14, 2022 12:09:24.027848959 CEST	192.168.2.3	8.8.8.8	0xe66d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 14, 2022 12:09:18.523155928 CEST	8.8.8.8	192.168.2.3	0xc04d	No error (0)	mail.dtvcambodia.com	dtvcambodia.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 12:09:18.523155928 CEST	8.8.8.8	192.168.2.3	0xc04d	No error (0)	dtvcambodia.com		192.185.162.134	A (IP address)	IN (0x0001)
May 14, 2022 12:09:18.673108101 CEST	8.8.8.8	192.168.2.3	0xc312	No error (0)	mail.dtvcambodia.com	dtvcambodia.com		CNAME (Canonical name)	IN (0x0001)
May 14, 2022 12:09:18.673108101 CEST	8.8.8.8	192.168.2.3	0xc312	No error (0)	dtvcambodia.com		192.185.162.134	A (IP address)	IN (0x0001)
May 14, 2022 12:09:24.049050093 CEST	8.8.8.8	192.168.2.3	0xe66d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 14, 2022 12:09:19.225521088 CEST	587	49852	192.185.162.134	192.168.2.3	220-jimmy.websitewelcome.com ESMTP Exim 4.94.2 #2 Sat, 14 May 2022 05:09:19 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 14, 2022 12:09:19.226907015 CEST	49852	587	192.168.2.3	192.185.162.134	EHLO 704672
May 14, 2022 12:09:19.368829966 CEST	587	49852	192.185.162.134	192.168.2.3	250-jimmy.websitewelcome.com Hello 704672 [102.129.143.55] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 14, 2022 12:09:19.369097948 CEST	49852	587	192.168.2.3	192.185.162.134	STARTTLS
May 14, 2022 12:09:19.513761997 CEST	587	49852	192.185.162.134	192.168.2.3	220 TLS go ahead

Target ID:	0
Start time:	12:07:20
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2C01EPgbbjrSPr7.exe"
Imagebase:	0xb50000
File size:	833536 bytes
MD5 hash:	DC6C55FEE2366DEE1D9C502BF061A8DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.286333778.000000000403F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	12:07:36
Start date:	14/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x700000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.507717756.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.279997636.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.279367854.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.280271675.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.279715834.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 00000004.00000002.509894637.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.9%
Total number of Nodes:	56
Total number of Limit Nodes:	3

Executed Functions

Function 02DA0040 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~=JQ, xrefs: 02DA02E6
7, xrefs: 02DA0100
7, xrefs: 02DA00F9

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: 7$7$~=JQ
API String ID: 0-1297039826
Opcode ID: 3cf0741b7ad30222caef592db5da25a82bdf2223acdc64c95cdc7d50086e2693
Instruction ID: d5bdcbe190f655360286e3681d90885f40c3dda25d150041b6e366e4da621971
Opcode Fuzzy Hash: 3cf0741b7ad30222caef592db5da25a82bdf2223acdc64c95cdc7d50086e2693
Instruction Fuzzy Hash: 30C12974D0420ADFCB04CFA6C4919AEFBB2FF89301B259559D416AB314DB34E942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DAA850 Relevance: 3.9, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/c+S, xrefs: 02DAA9EB
/c+S, xrefs: 02DAA9F2
'7,:, xrefs: 02DAA8B2

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: '7,:$/c+S$/c+S
API String ID: 0-3561956612
Opcode ID: d29347df139d01a04188e9e311e8ae20cad4fc7b95a47837f7cd8ab2cd20aac3
Instruction ID: 2be2c940e3f40a9d9f8a55b6147544cbd6db6cd4f3e0574a45c6b1087f2259ea
Opcode Fuzzy Hash: d29347df139d01a04188e9e311e8ae20cad4fc7b95a47837f7cd8ab2cd20aac3
Instruction Fuzzy Hash: 3B512574D06218DBCB04CFA5E590ADDFBF6BB89300F20A12AE446B7354E7349E86CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02DA9E90 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hjr), xrefs: 02DAA069
TYf, xrefs: 02DA9F3F

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: TYf$hjr)
API String ID: 0-1134518552
Opcode ID: 98ea94f1cde4a5e5255a5d2cc550324b0eea8619bbda50d27850979ab751c9f3
Instruction ID: 2b1bc40892f417bade96a8e8cea13393660b383e506c8fe6c6d37d4fe9036bdc
Opcode Fuzzy Hash: 98ea94f1cde4a5e5255a5d2cc550324b0eea8619bbda50d27850979ab751c9f3
Instruction Fuzzy Hash: 9371F471E15209DB8B04CFA5D5619EEFBB2EF89300F50942AD416F7314DB34AA42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DA9E81 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hjr), xrefs: 02DAA069
TYf, xrefs: 02DA9F3F

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: TYf$hjr)
API String ID: 0-1134518552
Opcode ID: 557c3f4b93b6b6ea538f23d73d74efd5b85e9d102ab0b75c2fcbc63b1803d57a
Instruction ID: 6debaf795290e52ac56f9311c05dd34eb2d564b9f2ccae3b455b0589094ece31
Opcode Fuzzy Hash: 557c3f4b93b6b6ea538f23d73d74efd5b85e9d102ab0b75c2fcbc63b1803d57a
Instruction Fuzzy Hash: 2771E271E15209DFCB44CFA5D5A19EEFBB2AF89300F10942AD406B7314DB34AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DAA83F Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/c+S, xrefs: 02DAA9F2
'7,:, xrefs: 02DAA8B2

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: '7,:$/c+S
API String ID: 0-553543793
Opcode ID: a18cd8ee89cefad30e71a3a0714fb53fa17211d8b92eccdd91b385907ed6f3a3
Instruction ID: 3a2f9a80ebeea2f520c08582c1ad133645dcd6428d8e5348eec14c02af4611da
Opcode Fuzzy Hash: a18cd8ee89cefad30e71a3a0714fb53fa17211d8b92eccdd91b385907ed6f3a3
Instruction Fuzzy Hash: D9510574E06219DFDB04CFA5E590ADDFBF2BB89310F24A12AE041B7354E7349A86CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02DA0007 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~=JQ, xrefs: 02DA02E6

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: ~=JQ
API String ID: 0-2431498397
Opcode ID: a04fee13c9278ae7f16958a2d049800770cd5753dec7171739b4fd558144a5df
Instruction ID: 390493693f5b1ce3c4c61aeb5ffd01fb87756c6aa7df4a32bae226b1cd7b3ea0
Opcode Fuzzy Hash: a04fee13c9278ae7f16958a2d049800770cd5753dec7171739b4fd558144a5df
Instruction Fuzzy Hash: 85D15870D0420ACFCB04CFA5C4919AEFBB2FF8A301B25955AD856AB315DB34E942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DA70E8 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

N4(-, xrefs: 02DA71A3

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: N4(-
API String ID: 0-1634684801
Opcode ID: a51300afea07ede623c5b5646885c60ce95c279b8d3152872186ba820949664e
Instruction ID: 28ea9e85fdb7b77c3626ccd553c8f87a43a7b8b4c2158aae906e5329cfcd1b7b
Opcode Fuzzy Hash: a51300afea07ede623c5b5646885c60ce95c279b8d3152872186ba820949664e
Instruction Fuzzy Hash: 67B127B4E052198BDB04CFE9C99199EFBF2BF89304F25D12AD805AB358D7349D42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02DA70D8 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

N4(-, xrefs: 02DA71A3

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: N4(-
API String ID: 0-1634684801
Opcode ID: 635e574a183d42b21f82b5d5bf3bb262b6c21809d8b5d56c75288ef3e6f90b08
Instruction ID: 3d396e62aae2f1090fafb1f5a39e911f8ebe98f876d586e5ae90e2c4eba8e44a
Opcode Fuzzy Hash: 635e574a183d42b21f82b5d5bf3bb262b6c21809d8b5d56c75288ef3e6f90b08
Instruction Fuzzy Hash: ECB135B4E052198FDB04CFA9C99199EFBF2BF89304F25D12AD805AB358D7349D42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02DA2830 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

W=t, xrefs: 02DA28B3

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: W=t
API String ID: 0-2133640408
Opcode ID: 300d47dcbbc6327a6bda512e41648dd07bd12f7efcd38fa630b96b6d28ab3dc2
Instruction ID: f4d9fc699699810de69816a4a62e1ed05113341abb6e137cd7d3ec152b2c4f8a
Opcode Fuzzy Hash: 300d47dcbbc6327a6bda512e41648dd07bd12f7efcd38fa630b96b6d28ab3dc2
Instruction Fuzzy Hash: 8A21CD71E046188BEB58CF6BD84469EFBF7AFC8200F04C1BAD909A7254DB341946CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DAAEB8 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edbc1c28027a1c6fe48482b4a435d397c6ea50b1da84b32190f56fce7dc6e2e
Instruction ID: 419cf40b0593ac94e6533b72b7db7253b65e5c8b4670bfd39481139d920c5560
Opcode Fuzzy Hash: 1edbc1c28027a1c6fe48482b4a435d397c6ea50b1da84b32190f56fce7dc6e2e
Instruction Fuzzy Hash: 7E910275E116298BDB28DF66CC44BD9BBB6EF89300F1082EAD509A7350EB705E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02DADFF0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9971f586acb651106e621dc750cba24c0f19d849e6583a68ce8af39ab2a51c77
Instruction ID: bc8391974aa6e24966f11e75487241b497801c2a3831a955a688613485e9cea3
Opcode Fuzzy Hash: 9971f586acb651106e621dc750cba24c0f19d849e6583a68ce8af39ab2a51c77
Instruction Fuzzy Hash: 0B115A30D042188BDB148FA5D529BEEBBF1AB4E305F249179D851B3390C7788988CB78

Uniqueness

Uniqueness Score: -1.00%

Function 02DAC418 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 02DAC56B

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d87a3e2aec68b17c53f841056247b543d7b9bee6d3a0b0e7ecf02b9cb74aa9e3
Instruction ID: d167ad256da84e55ff3d813528c3fe73c269cd13dde7f74d8e3419a8b26095a0
Opcode Fuzzy Hash: d87a3e2aec68b17c53f841056247b543d7b9bee6d3a0b0e7ecf02b9cb74aa9e3
Instruction Fuzzy Hash: E651F5719043289FDF20CF99C990BDDBBB5AF88314F15819AE908B7210DB759A88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02DAAAB5 Relevance: 1.6, APIs: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02DACEF5

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2a9cf625ad10e33ce401a6993ac836dcfe7ea204d314f8b5510977f0e67c3ac1
Instruction ID: 77207ff8759e0c5467c17e68554bbc0e1a16a72a76399207ee148a0d4c6e7d2b
Opcode Fuzzy Hash: 2a9cf625ad10e33ce401a6993ac836dcfe7ea204d314f8b5510977f0e67c3ac1
Instruction Fuzzy Hash: 5131E4B1909784DFEB01CF54CC54B9ABFB4FF29321F01845AD180AB291D3756984CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02DAC9C0 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02DACA4D

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 206306255ff9d48b55245c5f59ea7aa791fe287f7172ebdb1ba78e12d0ddbc01
Instruction ID: 9946aaddfe3bc0ffc13c67bfd2d1ee77928cf3bebab97e06ef8b53b2085ba6b4
Opcode Fuzzy Hash: 206306255ff9d48b55245c5f59ea7aa791fe287f7172ebdb1ba78e12d0ddbc01
Instruction Fuzzy Hash: DA2114B19042599FCB10CF9AD985BEEBBF4FF48324F00842AE919A3340D774A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DAC848 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02DAC8C7

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4c28b1c3365400172e5f61480abef042e951156806b2f990dcf7011cbb1c24a9
Instruction ID: 27790777c0738ae0cebfe365df7887b0292667787843330ca47f99eb18d4931a
Opcode Fuzzy Hash: 4c28b1c3365400172e5f61480abef042e951156806b2f990dcf7011cbb1c24a9
Instruction Fuzzy Hash: 6221D3B19052599FCB10CF9AD984BDEBBF4FB48320F10842AE918A7350D374A944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DAC788 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 02DAC7FF

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 0865ceccaeae866ae091af0a151ec05004d52e53553d816eb99669ccf925da76
Instruction ID: 3bf66d5815b9645a0430f280586861251b311bd26f72dda5cd0aade999b2a7cb
Opcode Fuzzy Hash: 0865ceccaeae866ae091af0a151ec05004d52e53553d816eb99669ccf925da76
Instruction Fuzzy Hash: B121F4B1D146599BCB00CF9AC985BAEFBF4BB48224F04816AD418A3340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DA5BF8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02DA5C6B

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5f5b2eddc1a413c2b01973c1c6962f29548d17fcfab54edb2bd2d5156baf8f76
Instruction ID: 5397598b9be4b4bf7ef3f316f1952984f5bf7cb14142c5215fa2ac7a0eaa8298
Opcode Fuzzy Hash: 5f5b2eddc1a413c2b01973c1c6962f29548d17fcfab54edb2bd2d5156baf8f76
Instruction Fuzzy Hash: C7210671D042499FCB10CF9AD584BDEBBF4EB48320F108429E558A7340D374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DA5BF0 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02DA5C6B

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a2b8fb0737c5fa4418a661e6cccfc32c9fa118485a4f222ace628bf41a98ff04
Instruction ID: f6b92586c0c73fe14de70cd7a7500a64e809609b86ae0b3ad2bb972e86e50b8c
Opcode Fuzzy Hash: a2b8fb0737c5fa4418a661e6cccfc32c9fa118485a4f222ace628bf41a98ff04
Instruction Fuzzy Hash: 762117B6D002499FCB10CF99D580BDEBBF0FB48324F148469E968A7310D778A945DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DAC918 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02DAC983

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0161261feca7226eb004465ad09a2c9b5408ec832a99eaa873b87271a1c174d8
Instruction ID: 3b6bb91d09c4ecfadb99639e3ef3f506efb8c0f236e8853bb4ae339709500c80
Opcode Fuzzy Hash: 0161261feca7226eb004465ad09a2c9b5408ec832a99eaa873b87271a1c174d8
Instruction Fuzzy Hash: 7911E0B59042499FCB10CF9AD984BDEBBF4FB88324F10845AE528A7310D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DAAB28 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02DACEF5

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9d16e15d9a96f9923a6a9873f26bc9af902122e723e3300444e1629c23da331e
Instruction ID: 979da8720721643df5b12737bf75acdf08504d45b396fe7bd66f2c4fe70b9500
Opcode Fuzzy Hash: 9d16e15d9a96f9923a6a9873f26bc9af902122e723e3300444e1629c23da331e
Instruction Fuzzy Hash: 5611F5B59043489FCB10CF99C595BEFBBF8EB48324F10845AE558A7700D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DACB78 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02DACBD7

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8f67421257e7ec802d0484938a188cc12ba46272dfeacd8c7ac08efe8e4b6436
Instruction ID: 4d1f4e8715df93dbc3ed3beaf4a5bff7cf377c463f74ed8e1b154cc8f999c3a3
Opcode Fuzzy Hash: 8f67421257e7ec802d0484938a188cc12ba46272dfeacd8c7ac08efe8e4b6436
Instruction Fuzzy Hash: 9611EEB19042498FCB10CF9AD984BDEBBF8EB88324F10845AD529A7340D779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02DA1DE0 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

;N`, xrefs: 02DA1F1B
;N`, xrefs: 02DA1F14

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: ;N`$;N`
API String ID: 0-2049779043
Opcode ID: faf67cf2c11b104fab278927908c9ee285a676b097b28e13d69c037912eb9e79
Instruction ID: 58aecb0451e26fca6a0db9aa232bd9b8b6d2c532a93a0c34c673187e0982edc8
Opcode Fuzzy Hash: faf67cf2c11b104fab278927908c9ee285a676b097b28e13d69c037912eb9e79
Instruction Fuzzy Hash: B36127B4E1521ADBCB04CFA6D4919AEFBB6FF88300F14902AD459AB344D3749A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DA75E8 Relevance: 1.6, Strings: 1, Instructions: 340COMMON

Download Yara Rule

Strings

D04l, xrefs: 02DA773B

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: D04l
API String ID: 0-4000787298
Opcode ID: 02c4e322967e0faa79aaf900d99c391a575c3a875ac654de47530776f41417b2
Instruction ID: e163d83523f92d9951fa111ac4a1c3f488f068821c5e83cf77254d6cfcf3272a
Opcode Fuzzy Hash: 02c4e322967e0faa79aaf900d99c391a575c3a875ac654de47530776f41417b2
Instruction Fuzzy Hash: EBC1BE75E0525A8FDB08CFB8C561AAEFBF2AF88214F258429D515E7354EB34DD01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DA1AC0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

>DS, xrefs: 02DA1BFE

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: >DS
API String ID: 0-2404021088
Opcode ID: 0af2b4b121c3831cb48464e666405fefe583c6b3812c761c12fd08d57fde2126
Instruction ID: b516e28fcd88a71fe6433955ab0cc52fe948501177d0a614e8051b0abb96c0df
Opcode Fuzzy Hash: 0af2b4b121c3831cb48464e666405fefe583c6b3812c761c12fd08d57fde2126
Instruction Fuzzy Hash: 1971E074E0520ADFCB04CF99D5919AEFBB2FF49210F149519D419AB304D734EA42CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DA1AB0 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

>DS, xrefs: 02DA1BFE

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: >DS
API String ID: 0-2404021088
Opcode ID: c8e1d7a16e37234ea4bf44a594476a87caeabb489b8153c65222b8e9f9146926
Instruction ID: c31e3c034961d15faff6d6b1d8af8671cce3e7480949356abc1f9059ef32b467
Opcode Fuzzy Hash: c8e1d7a16e37234ea4bf44a594476a87caeabb489b8153c65222b8e9f9146926
Instruction Fuzzy Hash: D761D174E0520ACFCB04CFA9C5919AEFBB2BF89210F14955AD459AB304D734DA42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DA2650 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

C/L, xrefs: 02DA26A7

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: C/L
API String ID: 0-360731833
Opcode ID: 7c46cf60d297687a992466c786e520e28662f307affbe39a1b86f45f825723c6
Instruction ID: f0bb9336343fc5e9e65781ca665ca0fcbc83060fbad101fe59681bc83353b150
Opcode Fuzzy Hash: 7c46cf60d297687a992466c786e520e28662f307affbe39a1b86f45f825723c6
Instruction Fuzzy Hash: 1041B9B0E1560ADBCB48CF9AC5559AEFBF2AF88300F24D569C905B7314D7349A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02DA264C Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

C/L, xrefs: 02DA26A7

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: C/L
API String ID: 0-360731833
Opcode ID: bae5c592d2de1f3a3f75b179c22eab4143dafbf2db2e2dfe652238c4001a9267
Instruction ID: 9dd09b73d3c39b2e647246cc9bf33336aae8ec2c18ba341bff46624d41d2cc03
Opcode Fuzzy Hash: bae5c592d2de1f3a3f75b179c22eab4143dafbf2db2e2dfe652238c4001a9267
Instruction Fuzzy Hash: 7A41D4B4E0560A9BCB08CF9AC5859AEFBB2EF88300F24D46AC905B7314D7349A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02DA282B Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

W=t, xrefs: 02DA28B3

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID: W=t
API String ID: 0-2133640408
Opcode ID: d07f55d77271b0548bfb65127cd955bb8a4e7c3f953cf9f54b5000ca131399c8
Instruction ID: f6123f0073078dfd32b9e5423e5fb762d4528c983cc6d52b1a9efa48e11fe1c4
Opcode Fuzzy Hash: d07f55d77271b0548bfb65127cd955bb8a4e7c3f953cf9f54b5000ca131399c8
Instruction Fuzzy Hash: 8811CB71E046189BEB5CCF6BD84469EFAF3AFC8300F04C17AD908A6258EB3409468F55

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7AD8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e0ff1667198f86b33219a664d163c6b180b69163da7a50db54743235bc94e9
Instruction ID: d64732605a20bf95b1697eeba31121fd28ba318a89b59cf540d2371e3cc41a42
Opcode Fuzzy Hash: b6e0ff1667198f86b33219a664d163c6b180b69163da7a50db54743235bc94e9
Instruction Fuzzy Hash: B9C127B0E05219DFDB14CFA9C990AAEFBB2FF89200F249169D509AB355DB309E41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7AC8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92049f6c095dea8f802e4a7295ab71c81a72a974a9ac9a6d2358cbc3e5ee3e1
Instruction ID: ce0ebb551381729a4b23ecbc298ed06a6c18ceff5e24afea755909fee72700aa
Opcode Fuzzy Hash: d92049f6c095dea8f802e4a7295ab71c81a72a974a9ac9a6d2358cbc3e5ee3e1
Instruction Fuzzy Hash: 7FC158B0E15219CFDB14CFA9C990AAEFBF2BF89200F24916AD409AB355D7309E41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7B83 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1076d09f628880cd97125d2fc7b29ada01efd8d6580cf3f04c86011f1f8237ad
Instruction ID: 04a9d8bc12bbfbe51a827c2a3734ad5816263fa39456a922d592da7ef1118b0b
Opcode Fuzzy Hash: 1076d09f628880cd97125d2fc7b29ada01efd8d6580cf3f04c86011f1f8237ad
Instruction Fuzzy Hash: 7EB147B4E05219CFDB14CFA8C990AAEFBB2FF89204F2495A9D509AB355D7309E41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7C20 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2797018d36c65f00a88dc9f7a9e01b3d4536ff25f8eadbdd1f404b1c8db764fe
Instruction ID: 78872c0451b7adca75cf0a08397ef7b06426451e6a77035479438c130756a04f
Opcode Fuzzy Hash: 2797018d36c65f00a88dc9f7a9e01b3d4536ff25f8eadbdd1f404b1c8db764fe
Instruction Fuzzy Hash: 40A157B0E05219DFDB14CFA8CA90AAEF7B2FF89204F209569D40AAB355D7309E41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DA0F00 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8330358916d6a8148835730498051e9caded26f3f6f7f25334ff62ba85286afb
Instruction ID: 7053d43aa1d94a6aaa612a5e4e159472b25e6617a1f7c82b9d2b63851af8b30b
Opcode Fuzzy Hash: 8330358916d6a8148835730498051e9caded26f3f6f7f25334ff62ba85286afb
Instruction Fuzzy Hash: B581CF74E10219CFCB04CFA9C58499EFBF2FF88251F249569E419AB364D330AA42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02DA0EF0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9109fda15f1b7bec8741b944d98ff2d2b0e2924ae73af9c1927ab5748c6ba255
Instruction ID: 031b70989fecb830ffab3fe8d2fe0e5761f413e0056418409fd7a7610cd2a7ab
Opcode Fuzzy Hash: 9109fda15f1b7bec8741b944d98ff2d2b0e2924ae73af9c1927ab5748c6ba255
Instruction Fuzzy Hash: D671E074E10219CFCB04CFA9C58499EBBF2FF88211F24956AE419AB364D330AE46CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02DA3300 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467fd2c52b95beefa6689d0ec9e01700fd7a2520755aa58663dd5d5a5e9ec058
Instruction ID: b9d194d71a4e77d28374d1c8f0afa4ace5bd1bbe189fa60e767469e322c16810
Opcode Fuzzy Hash: 467fd2c52b95beefa6689d0ec9e01700fd7a2520755aa58663dd5d5a5e9ec058
Instruction Fuzzy Hash: C871FE71E046558FDB59CF7B895428AFBB3AFCA214F19C1FAC8889A215DF340986CF11

Uniqueness

Uniqueness Score: -1.00%

Function 02DA23A8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ce07437a27663c17b771ce5888b98905a029863d26fcafc947e9c5d5627120
Instruction ID: 591befe46494b985b065d07e6519e5d2a1450d0a0646c04e39e3e33d3f05acb2
Opcode Fuzzy Hash: 45ce07437a27663c17b771ce5888b98905a029863d26fcafc947e9c5d5627120
Instruction Fuzzy Hash: 61711370E152198FCB08CFAAC9959DEBBF2BB99310F24942AD815F7354D3349A41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7808 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf945084d8d590e9ad88fd3f09ad8f95592d3e8e2f89d51ce2400509dbcf378
Instruction ID: 22dd00ebc9237235102b59a91849dc154bd66b9db13be87f6a18a1f5cbc2e06d
Opcode Fuzzy Hash: fdf945084d8d590e9ad88fd3f09ad8f95592d3e8e2f89d51ce2400509dbcf378
Instruction Fuzzy Hash: 74613B70E0521A9FEB04CFAAC490AAEFBF2BF89310F14D42AD415A7354D7349A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DA23B8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0fe42f2d50b856779b03c3d5f06419318cd0f68ac43d9224d5531ee43b676d
Instruction ID: 85877594c04e0efc6247e4aa289eb97c9f59fd8c34e9eb35922572ffebeb1ab4
Opcode Fuzzy Hash: 7e0fe42f2d50b856779b03c3d5f06419318cd0f68ac43d9224d5531ee43b676d
Instruction Fuzzy Hash: D7710270E152198BCB08CFAAC5959DEFBF2BF98310F24942AD815BB354D3749A41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02DA1DD0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41f8d92368f578f4d5f610446dd62f60fdcb5d1a04e2d56229ee09879195c6e
Instruction ID: edf568ca3f55aa15a22472a0be888eb81f8251b00d69c53986733aa220f01101
Opcode Fuzzy Hash: c41f8d92368f578f4d5f610446dd62f60fdcb5d1a04e2d56229ee09879195c6e
Instruction Fuzzy Hash: F56138B5E0521A9BCB04CFA5D4519AEFBF2FF88300F14906AD419A7344D378DA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DA2158 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf732df8a64741018400bb6d04feaaaeac63151ebbedda85dacad822593865f
Instruction ID: 6b899e9dd80ef29f1995b64827e5187b5938b100a31ea92bcf4ed7de43bdfd66
Opcode Fuzzy Hash: 5bf732df8a64741018400bb6d04feaaaeac63151ebbedda85dacad822593865f
Instruction Fuzzy Hash: 02512A75D1460A8FCB04CFA6C8459AEBBF2AF89310F24C56AC915A7354D7349A42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02DA2168 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2109b3c862210f6cdcfbec3cdf710c61477480e46263dee74573c25c33343305
Instruction ID: 785ec784594cb2a601c50e4e2e15ee5dfdc936826fbf479ad62832a836e03f77
Opcode Fuzzy Hash: 2109b3c862210f6cdcfbec3cdf710c61477480e46263dee74573c25c33343305
Instruction Fuzzy Hash: 3951F975D1460A9BCB04CFAAC4859EEFBF2AF88300F24D42AC955A7354D7349A42CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DA33B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be86e4facfa71f3d9911156d7847bdfe354e7c1f468ce9bb354945a13559298
Instruction ID: 2f94518b4c7f55000e4475279a412e3c82f53b80ac12fa1399a143a883f43765
Opcode Fuzzy Hash: 2be86e4facfa71f3d9911156d7847bdfe354e7c1f468ce9bb354945a13559298
Instruction Fuzzy Hash: 24416D71E116588BDB68DF6B9D4579EFBF3AFC8300F14C1BA850CA6214DB300A858F11

Uniqueness

Uniqueness Score: -1.00%

Function 02DAA1D0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f39e7e6936febceeb174ff91cfb8115089751ec90592c55dec5951272e7cf9f
Instruction ID: 2816b5f3533be2778238f9c050c2523da8fd95de186e0683ecd2bd81c252225d
Opcode Fuzzy Hash: 7f39e7e6936febceeb174ff91cfb8115089751ec90592c55dec5951272e7cf9f
Instruction Fuzzy Hash: B0110671E112199BDB48CFABD940AAEFBF7ABC8210F14C13AD508A7214DB305A02CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02DA8D98 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c8221b3e53a0b59b106ee19d836f5c8b6f41457dde719810ccbb7f2be013fd
Instruction ID: 8545d6c699dfeb2e724b8a844685b170510e9384cfe37b0499db5a0b5bd0628d
Opcode Fuzzy Hash: 39c8221b3e53a0b59b106ee19d836f5c8b6f41457dde719810ccbb7f2be013fd
Instruction Fuzzy Hash: 1B111471E116188BDB18CFABD941AEEFBF7ABC8210F14C06AD808A7254DB315A018F91

Uniqueness

Uniqueness Score: -1.00%

Function 02DAA1CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cac07878b0e20aa5b205eac8cf0b7687da8b48037c430cfb72c5ea98240c53
Instruction ID: 77ea22ace46cfe022fe5fdbef7cdcb399ead303447a14ce35c119a5116567a5b
Opcode Fuzzy Hash: f8cac07878b0e20aa5b205eac8cf0b7687da8b48037c430cfb72c5ea98240c53
Instruction Fuzzy Hash: 3311B971E116199BDB48CF6BD945AAEFAF7AFC8200F14C13A9408B6354DB304A42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02DA8D97 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.282363540.0000000002DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2da0000_2C01EPgbbjrSPr7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f28ffb0a3824f01ca605c999d68ae7007be3a986d048a506ac64b2b9b9b43db9
Instruction ID: 337934950b5ceefc1f8ddb54bfe4fb39fdf8423f8a774835e52fd3ec163c62bf
Opcode Fuzzy Hash: f28ffb0a3824f01ca605c999d68ae7007be3a986d048a506ac64b2b9b9b43db9
Instruction Fuzzy Hash: 2011F5B0E116188BDB58CFABD9416AEFBF7AFC8200F14C02AD808E7354DB304A018F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 6108, Parent PID: 6992COMMON

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	5

Executed Functions

Function 05EDC99E Relevance: 12.9, APIs: 8, Instructions: 936
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryDosDeviceA.KERNEL32 ref: 05EDC9E3
LoadModule.KERNEL32 ref: 05EDCAA9
SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedDeviceFlagsInitializeLabelLoadLocalModuleQueryThunkUnregisterUntilVolumeWait
String ID:
API String ID: 3705852545-0
Opcode ID: 0ba605c7b1ab11b783e09a0919cec874a5997c59e680f086c1708abd8f4392f0
Instruction ID: 2a3ae287cb52a07b741bcaed0df8bbe648025485a4f6d1f9997f3af8db803187
Opcode Fuzzy Hash: 0ba605c7b1ab11b783e09a0919cec874a5997c59e680f086c1708abd8f4392f0
Instruction Fuzzy Hash: F2A2F574A01228CFCB65EF64DD58B99B7B6BF48305F1081EAD50AA3350DB35AE86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00E234A0 Relevance: 4.5, APIs: 1, Instructions: 3045COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4545adc687222126a0508d4ebfc8461e0e5217c08e5b036a4d4063a9ec5f64d5
Instruction ID: 4338dff48a97e0fcd4a047b54d87fe496853c9bea962f28f2f7f8993c9ea7634
Opcode Fuzzy Hash: 4545adc687222126a0508d4ebfc8461e0e5217c08e5b036a4d4063a9ec5f64d5
Instruction Fuzzy Hash: 6B63FA71D10A59CACB11EF68C984699F7B1FF95304F15D79AE448BB221EB30AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00E231A0 Relevance: 4.4, APIs: 1, Instructions: 2898COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32 ref: 00E25798

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: 32ade08b892eb264bc4053e691b5916107e0f37dfd07168710ccbe8df9461ca1
Instruction ID: 689d11255d1c545441908f89b77b6f466ba5ebde2042e98d67b642260de71d60
Opcode Fuzzy Hash: 32ade08b892eb264bc4053e691b5916107e0f37dfd07168710ccbe8df9461ca1
Instruction Fuzzy Hash: 9563FA31D10A59CACB11EF68C984A99F7B1FF95304F15D79AE4487B221EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05ED5594 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05EDB20B

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f5b5ef980ff9c3ebf23b253effd409f7964f8ee3d2ff64367bb9041d2d55836e
Instruction ID: 8296eb2b203b785fb7275949f2e18110b6d02ec31ced2cff3906854e9e9145ec
Opcode Fuzzy Hash: f5b5ef980ff9c3ebf23b253effd409f7964f8ee3d2ff64367bb9041d2d55836e
Instruction Fuzzy Hash: 30511170D002188BDB18CFA9C888B9DFBB5BF48314F159129E855AB350E7749845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05EDC9BF Relevance: 12.6, APIs: 8, Instructions: 609
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryDosDeviceA.KERNEL32 ref: 05EDC9E3
LoadModule.KERNEL32 ref: 05EDCAA9
SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedDeviceFlagsInitializeLabelLoadLocalModuleQueryThunkUnregisterUntilVolumeWait
String ID:
API String ID: 3705852545-0
Opcode ID: 832b797c96f260a4250cdffaaee9754c1ffd5be981f3a2701f54078a1aaf89d1
Instruction ID: d48197bde8e3cb25f5fe91bdd098baa41b35e1b4448b03f7c0277cb517e2de78
Opcode Fuzzy Hash: 832b797c96f260a4250cdffaaee9754c1ffd5be981f3a2701f54078a1aaf89d1
Instruction Fuzzy Hash: A7521674A00228CFCB65DF74D958799BBB6BF48306F1091EAD50AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCA04 Relevance: 11.1, APIs: 7, Instructions: 602
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadModule.KERNEL32 ref: 05EDCAA9
SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedFlagsInitializeLabelLoadLocalModuleThunkUnregisterUntilVolumeWait
String ID:
API String ID: 4072977434-0
Opcode ID: a0d223fe7377074c96ab0e2b3dba3a1bac6a5fc351242d57f88f420753d2830a
Instruction ID: a0abd1c27902e58f187cf1d4aabedfedc1a02d14fb71ed8a3171be82349fc972
Opcode Fuzzy Hash: a0d223fe7377074c96ab0e2b3dba3a1bac6a5fc351242d57f88f420753d2830a
Instruction Fuzzy Hash: DA521774900228CFCB65DF74D998799BBB6BF48306F1091EAD50AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCA49 Relevance: 11.1, APIs: 7, Instructions: 593
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadModule.KERNEL32 ref: 05EDCAA9
SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedFlagsInitializeLabelLoadLocalModuleThunkUnregisterUntilVolumeWait
String ID:
API String ID: 4072977434-0
Opcode ID: 2a25e639df9940b76dd283e3efba3bc83ac6ea50783bd0485eea054f1cf00f63
Instruction ID: 76632d65f9bf706b45e7a3b6f4df959e3b2df139c243e8a9b3e993483525349b
Opcode Fuzzy Hash: 2a25e639df9940b76dd283e3efba3bc83ac6ea50783bd0485eea054f1cf00f63
Instruction Fuzzy Hash: 02521674A00228CFCB65DF74D958799BBB6BF48306F1091EAD50AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCA85 Relevance: 11.1, APIs: 7, Instructions: 588
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadModule.KERNEL32 ref: 05EDCAA9
SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedFlagsInitializeLabelLoadLocalModuleThunkUnregisterUntilVolumeWait
String ID:
API String ID: 4072977434-0
Opcode ID: 93818f159c9b9ce9553fdf09d4776ccc2b6390da1559b99be9392d365c1acef1
Instruction ID: b3422a7d20ec07d42b501db5f46dbaa6c02107b651690f4ed99a0eaa4cf2e9f9
Opcode Fuzzy Hash: 93818f159c9b9ce9553fdf09d4776ccc2b6390da1559b99be9392d365c1acef1
Instruction Fuzzy Hash: 2D521674A00228CFCB64DF74D958799BBB6BF48306F1091EAD54AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCACA Relevance: 9.6, APIs: 6, Instructions: 581
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetVolumeLabelW.KERNEL32 ref: 05EDCAEE
LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedFlagsInitializeLabelLocalThunkUnregisterUntilVolumeWait
String ID:
API String ID: 2945044011-0
Opcode ID: c9ae0e4a607de5877cb8bfbc75b9494a7857118a57d9ededb7dc6f2a9bb0ca74
Instruction ID: c3236449a235f0f23dbb55c21df6c70774a94f047ebc2d296f844a5c8661ee1a
Opcode Fuzzy Hash: c9ae0e4a607de5877cb8bfbc75b9494a7857118a57d9ededb7dc6f2a9bb0ca74
Instruction Fuzzy Hash: C7521674A00228CFCB64DF74D958799BBB6BF48306F1091EAD50AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCB0F Relevance: 8.1, APIs: 5, Instructions: 574
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFlags.KERNEL32 ref: 05EDCB33
UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedFlagsInitializeLocalThunkUnregisterUntilWait
String ID:
API String ID: 3574001451-0
Opcode ID: c302401a00f268d7e3b2db3cba92172f4c8f79fd595662b1e68c8078cfc1e7bd
Instruction ID: fec1a6f11f4fae1e38dff2c565075d52b3ff2d095859dd59b55cd434a7791232
Opcode Fuzzy Hash: c302401a00f268d7e3b2db3cba92172f4c8f79fd595662b1e68c8078cfc1e7bd
Instruction Fuzzy Hash: 2C421774A00228CFCB64DF74D958799BBB6BF48306F1091EAD50AA3350DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E229E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryTransactedW.KERNEL32(00000000), ref: 00E22D9D

Strings

\, xrefs: 00E22BE3
\, xrefs: 00E22C1E
\, xrefs: 00E22A59

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID: CreateDirectoryTransacted
String ID: \$\$\
API String ID: 3398158531-3791832595
Opcode ID: d5c1b6a2ba7479305b44599084c67a8436a29fd9b02ee7e93067b972b351c2db
Instruction ID: b0a807367260a056dd1186cbb8c8d6a8b6da9a360dc9b4c51bba628dc9766c08
Opcode Fuzzy Hash: d5c1b6a2ba7479305b44599084c67a8436a29fd9b02ee7e93067b972b351c2db
Instruction Fuzzy Hash: F3A1F471B006249FDB28EB7898517BE77E2AF88318F14952DD616EB784EB309C4687D0

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCB54 Relevance: 6.6, APIs: 4, Instructions: 567
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnregisterWaitUntilOOBECompleted.KERNEL32 ref: 05EDCB78
KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$CompletedInitializeThunkUnregisterUntilWait
String ID:
API String ID: 906585097-0
Opcode ID: a12851a454f880b1cc69c4aa684bf0e835fb0fcc1e1158e71f63c582cc3134e0
Instruction ID: 740f4a75b90ccb5edfd7e681d15a19ed5b5fed72b63c524195a41fdce7106fa6
Opcode Fuzzy Hash: a12851a454f880b1cc69c4aa684bf0e835fb0fcc1e1158e71f63c582cc3134e0
Instruction Fuzzy Hash: 29421674A00228CFCB64DF74D958799BBB6BF48306F1081EAD50AA3340DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F66B4B Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F66BB0
GetCurrentThread.KERNEL32 ref: 00F66BED
GetCurrentProcess.KERNEL32 ref: 00F66C2A
GetCurrentThreadId.KERNEL32 ref: 00F66C83

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f6b275466ba29718611d7f84ace4926137455baa670d93e1ac8f876efa46acef
Instruction ID: 66348653632f3d690a0533767deae1a4593b7e5bb1511892bd919c2605c10bdc
Opcode Fuzzy Hash: f6b275466ba29718611d7f84ace4926137455baa670d93e1ac8f876efa46acef
Instruction Fuzzy Hash: E55133B0D046488FDB18CFA9D648B9EBBF0FF88314F208559E459A7390D7746984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F66B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F66BB0
GetCurrentThread.KERNEL32 ref: 00F66BED
GetCurrentProcess.KERNEL32 ref: 00F66C2A
GetCurrentThreadId.KERNEL32 ref: 00F66C83

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: adad3a29bd50000de4e53bfd96a0b6fb5dacd7ea8fc773270e3296aaad37d0ba
Instruction ID: 56bd2e33495e550d3e5714f231403f380ccc403386f172fcf4aa56d741e3e941
Opcode Fuzzy Hash: adad3a29bd50000de4e53bfd96a0b6fb5dacd7ea8fc773270e3296aaad37d0ba
Instruction Fuzzy Hash: BC5122B0E046488FDB14CFAAD648B9EBBF0FB88314F208459E459B7390D7746984CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCB99 Relevance: 5.1, APIs: 3, Instructions: 560
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 3042ef0ab616cc2614b95d7f872bae8d5ebedf5eade29f3f5831b95e25d6c343
Instruction ID: c9715715776037d2123de2a3050970b467de2d039b5a7731498e60a502241ef4
Opcode Fuzzy Hash: 3042ef0ab616cc2614b95d7f872bae8d5ebedf5eade29f3f5831b95e25d6c343
Instruction Fuzzy Hash: D4421774A00228CFCB64DF64DD58799BBB6BF48306F1091EAD50AA3350DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCBDE Relevance: 5.1, APIs: 3, Instructions: 553
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a32fa2dea78b21d82442fa5535d169f5ec9854062da74bf3dcddd8a9f43f972f
Instruction ID: 75ee5edffae21b382e0034b4443713f2efbde52ea42ba44f625b7144d862c0b4
Opcode Fuzzy Hash: a32fa2dea78b21d82442fa5535d169f5ec9854062da74bf3dcddd8a9f43f972f
Instruction Fuzzy Hash: 03421774A00229CFCB64DF64DD58799BBB6BF48306F1081EAD50AA3350DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCC23 Relevance: 5.0, APIs: 3, Instructions: 546libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 568b8057801e438bd81a1f44c830fe66e89d39f4555b88032953534f308263ca
Instruction ID: e884a2d16e80f019eb21f8da5ed37cb49023d7eb5a7241b8d72a72d1e529e709
Opcode Fuzzy Hash: 568b8057801e438bd81a1f44c830fe66e89d39f4555b88032953534f308263ca
Instruction Fuzzy Hash: 4F421874A00229CFCB64DF64DD58799BBB6BF48306F1081EAD50AA3350DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCC68 Relevance: 5.0, APIs: 3, Instructions: 539libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b9e61f8e881874d5a29d262e4849b632978fa6939763214118c81d64dbc45e3a
Instruction ID: 860485c0a748661c678d53aa346674d0bb4ea7dbf7e8847da8ff3815306794b1
Opcode Fuzzy Hash: b9e61f8e881874d5a29d262e4849b632978fa6939763214118c81d64dbc45e3a
Instruction Fuzzy Hash: CA422774A00229CFCB24DF64D958799B7B6BF48306F1081EAD50AA3340DB35AE86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCCAD Relevance: 5.0, APIs: 3, Instructions: 532libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 54cb62f286a226ab87104bac7e83c8237a0885256c86332d28d97c6edd978ff8
Instruction ID: 95dd38eadb8115bade0169dad36b3715d8b709dd1b53eafe3c1eb73119e5bee4
Opcode Fuzzy Hash: 54cb62f286a226ab87104bac7e83c8237a0885256c86332d28d97c6edd978ff8
Instruction Fuzzy Hash: E7421774A00229CFCB64DF64D958B9DB7B6BF88305F1081EAD50AA3350DB35AE86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCCF2 Relevance: 5.0, APIs: 3, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7e9c2f3f485abff2bf6b8c2987a752652143d6ddfee0d4a1f9974747117d175b
Instruction ID: a576fb969a2b80aa8eeb331f815630e7d56b86af24c058e62eafd5cf0b35661a
Opcode Fuzzy Hash: 7e9c2f3f485abff2bf6b8c2987a752652143d6ddfee0d4a1f9974747117d175b
Instruction Fuzzy Hash: 5F321874A01229CFCB24DF64D95879DB7B6BF48305F1081EAD50AA3350DB35AE86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCD37 Relevance: 5.0, APIs: 3, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 975cfcabb83cb6a28e73972086b92e44665c111c4a219c929a390c352a2aef34
Instruction ID: 31ae458bc0073ab51b554f4c9a330dc51c2bd919ef144fadeddcb09021f7c630
Opcode Fuzzy Hash: 975cfcabb83cb6a28e73972086b92e44665c111c4a219c929a390c352a2aef34
Instruction Fuzzy Hash: EB321774A00229CFCB24DF64D958B9DB7B6BF88305F1081EAD54AA3350DB35AE86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCD7C Relevance: 5.0, APIs: 3, Instructions: 511libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d01a8f9331bb6b7e6b8024571de6762bd4788962ea04ce47e1f5307b5461c5e3
Instruction ID: d2b8711b8c378d332bb5234c2f628cc22b239e8aa832e33ae5f78ffcdd0b3a7f
Opcode Fuzzy Hash: d01a8f9331bb6b7e6b8024571de6762bd4788962ea04ce47e1f5307b5461c5e3
Instruction Fuzzy Hash: 00321774A00229CFCB24EF64DD58799B7B6BF88305F1081EAD54AA3350DB359E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCDC1 Relevance: 5.0, APIs: 3, Instructions: 504libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: dbebfc11cebcd746db2b8265cdd14050e38abede4f7a72009e1801593f7de3d1
Instruction ID: 0cc61aa16378c2484820cf7777c939ab302eb4d6254b938bf3351f6ecab58fa2
Opcode Fuzzy Hash: dbebfc11cebcd746db2b8265cdd14050e38abede4f7a72009e1801593f7de3d1
Instruction Fuzzy Hash: 8E322774A00229CFCB64EF64DD58B99B7B6BF88305F1081EAD54AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCE06 Relevance: 5.0, APIs: 3, Instructions: 497libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7f4c3b58cde0313274c8f31f63505f1723f92bf0b09e35d43e3b605079dc2aeb
Instruction ID: 3e28c483db71951a53e5f4448c7196375952c4d73cd45dc45925db22fdd31538
Opcode Fuzzy Hash: 7f4c3b58cde0313274c8f31f63505f1723f92bf0b09e35d43e3b605079dc2aeb
Instruction Fuzzy Hash: 0F322774A00229CFCB24EF64DD58B99B7B6BF88305F1081EAD54AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCE4B Relevance: 5.0, APIs: 3, Instructions: 490libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDCE6F
KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ff41852841ad195a166ad875e65e777b4688dba4217683c020a3aa2e7612ec28
Instruction ID: b4d1720ee4e1e1a4fc0de5db81ad51f760cdc984911be4912e1db0fde39c6e1d
Opcode Fuzzy Hash: ff41852841ad195a166ad875e65e777b4688dba4217683c020a3aa2e7612ec28
Instruction Fuzzy Hash: 4F321674A04229CFCB24EF64DD58B99B7B6BF88305F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCEA6 Relevance: 3.5, APIs: 2, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: bda2af4159a5623202ea0907a6a052a4576aa36cc059cdd6541d76406039cf32
Instruction ID: 703305d44af96ad6f207822ed0a027d9c67c95ea8651ca184a2730e9259382cd
Opcode Fuzzy Hash: bda2af4159a5623202ea0907a6a052a4576aa36cc059cdd6541d76406039cf32
Instruction Fuzzy Hash: 9F220674A05229CFCB24EF64DD58B99B7B6BF88305F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCEEB Relevance: 3.5, APIs: 2, Instructions: 472libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9a46806e410d421c07b8fc7f0242447df26819f0308ba05f4668206c743ac2b9
Instruction ID: f29de36e27983900728d55f06625225063d7f8fd4ad36f4f487c1f2539ddfa3a
Opcode Fuzzy Hash: 9a46806e410d421c07b8fc7f0242447df26819f0308ba05f4668206c743ac2b9
Instruction Fuzzy Hash: 79221674A05229CFCB24EF64DD58B99B7B6BF88305F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCF30 Relevance: 3.5, APIs: 2, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 44f1aa35453239d46b79cde12a542a7b1d590b72b9224e49fa4ff43eb16936c8
Instruction ID: 57e8077c681730a206f653d105c5f1f7103a5eefd763df82fe3c897db5bb9811
Opcode Fuzzy Hash: 44f1aa35453239d46b79cde12a542a7b1d590b72b9224e49fa4ff43eb16936c8
Instruction Fuzzy Hash: 94220674A05229CFCB24EF64DD58B99B7B6BF88305F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCF8B Relevance: 3.5, APIs: 2, Instructions: 454libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: d1c42f6cf7ca24de4b61cb236617620f24eb0818bd605af636cd4d80abe1afbf
Instruction ID: 2265c7d0d4fe2067ea9688560068e8881032967e93b33f742e776e6115d1df91
Opcode Fuzzy Hash: d1c42f6cf7ca24de4b61cb236617620f24eb0818bd605af636cd4d80abe1afbf
Instruction Fuzzy Hash: 44220674A05229CFCB24EF64DD58B99B7B6BF88305F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDCFD0 Relevance: 3.4, APIs: 2, Instructions: 447libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 5b43faf2913a1c38e86fdbf3f7ef44de347bebfa9c0a3ad38ed3b14809d0fa0c
Instruction ID: 2b66b17f24ce5e84b731fe3affbe35bd5163d75dd7ffc10931706aa7d6660605
Opcode Fuzzy Hash: 5b43faf2913a1c38e86fdbf3f7ef44de347bebfa9c0a3ad38ed3b14809d0fa0c
Instruction Fuzzy Hash: 89220674A05229CFCB24EF64DD58B9DB7B6BF88205F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD015 Relevance: 3.4, APIs: 2, Instructions: 440libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 720156ce244e2dd9b2220c4bd8e920c9a85f3c3ee3850e60b132318f516d92e6
Instruction ID: 23be2d87192b5d4ebc11103f752fb65d148095ed84091e253969e1ba9f9934cb
Opcode Fuzzy Hash: 720156ce244e2dd9b2220c4bd8e920c9a85f3c3ee3850e60b132318f516d92e6
Instruction Fuzzy Hash: 66120674A05229CFCB24EF64DD58B9DB7B6BF88205F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD05D Relevance: 3.4, APIs: 2, Instructions: 433libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 6f42b011b47fba841d67552033f7803b3728a5c5ca348ff7d1ad09839e9e3ce7
Instruction ID: cf21217f0b13a72773fc4f30c83f06eb74cba11b89d774f9c5e0add5c2b637ab
Opcode Fuzzy Hash: 6f42b011b47fba841d67552033f7803b3728a5c5ca348ff7d1ad09839e9e3ce7
Instruction Fuzzy Hash: 10121674A052298FCB24EF74DD58B9DB7B6BF88205F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD0A5 Relevance: 3.4, APIs: 2, Instructions: 426libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e5ffda2302f99704334cf7f16120e8ae3b0b33305501919108b5e4af352cc8ed
Instruction ID: 9f030f423a38c0c5f9d8d794daad5a2438e816991f6913264bbb93a6a9f4dcc4
Opcode Fuzzy Hash: e5ffda2302f99704334cf7f16120e8ae3b0b33305501919108b5e4af352cc8ed
Instruction Fuzzy Hash: 72121674A042298FCB24EF64DD58B9DB7B6BF88205F1085EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD0ED Relevance: 3.4, APIs: 2, Instructions: 419libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: fd530e407c845340a2168e1d616def8e65a0b6bfa4b77531d8c7e0152451392b
Instruction ID: 686e92f0cc74fb761027d951fc9616e77c75a1189427e757132c45bfebb2615f
Opcode Fuzzy Hash: fd530e407c845340a2168e1d616def8e65a0b6bfa4b77531d8c7e0152451392b
Instruction Fuzzy Hash: C8122774A052298FCB24EF74DD58B9DB7B6BF88205F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD135 Relevance: 3.4, APIs: 2, Instructions: 412libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 03636e62400a466aab750926860b5e1b66bb102959bdd919868a26e8bf690807
Instruction ID: 7b3361de8e1aa8ef63620d293efd89653efb03711a34f87df152445af9ef79fe
Opcode Fuzzy Hash: 03636e62400a466aab750926860b5e1b66bb102959bdd919868a26e8bf690807
Instruction Fuzzy Hash: 70122774A042298FCB24EB74DD58B9DB7B6BF88205F1081EAD50AA3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD17D Relevance: 3.4, APIs: 2, Instructions: 405libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: eb854942bf2a412dd486bb1206ece55cc16c5f214cedb841994a1b80e35d8ea0
Instruction ID: 083d43a77c009fd01eab38311e8db7f859a73e12b0f4ba9071c197276e9c7462
Opcode Fuzzy Hash: eb854942bf2a412dd486bb1206ece55cc16c5f214cedb841994a1b80e35d8ea0
Instruction Fuzzy Hash: BF021774A042298FCB24EB74DD58B9DB7B6BF88205F1085EAD50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD1C5 Relevance: 3.4, APIs: 2, Instructions: 396libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05EDD1E0
LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 67e240c7782cc0dd18d218b151a1c0773e0bb58980c7ad129b265642a58a0222
Instruction ID: 9e007656a0ee2136337d0061bad8061c7d299e7478777369c7aca4bca05e4e1f
Opcode Fuzzy Hash: 67e240c7782cc0dd18d218b151a1c0773e0bb58980c7ad129b265642a58a0222
Instruction Fuzzy Hash: 0E0217B4A042298FCB24EB74DD58B9DB7B6BF88205F1085E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD201 Relevance: 1.9, APIs: 1, Instructions: 391libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 24bfa28fcca1b1d0f339ca3d177e695e93708aa57fbd3a3c079483246b5a51ae
Instruction ID: 36fda570ff51985c4dd07962200f1d9d8fae2e2d4eaa151a64fb27f06b1c38ce
Opcode Fuzzy Hash: 24bfa28fcca1b1d0f339ca3d177e695e93708aa57fbd3a3c079483246b5a51ae
Instruction Fuzzy Hash: 130226B4A042298FCB24EB74DD58B9DB7B6AF88205F1085E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD249 Relevance: 1.9, APIs: 1, Instructions: 384libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1e40514c291eeffd3284526e345680a654d77c6c7f4af980dafb0b666467b83a
Instruction ID: 268740ba2cdb05fd120b24a19e35d10f3ab36c6507ebe7a5ec7756e797135a98
Opcode Fuzzy Hash: 1e40514c291eeffd3284526e345680a654d77c6c7f4af980dafb0b666467b83a
Instruction Fuzzy Hash: 850226B4A042298FCB24EF74DD58B9DB7B6AF88205F1085E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD291 Relevance: 1.9, APIs: 1, Instructions: 377libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09486536a25d47e1929a8e49fc6413ba2e156bdee1ff5b80abc56827f65197b5
Instruction ID: 26e918b1d138297d9eaac8870668df19e82d428cd195cb5ab272e74832d5b875
Opcode Fuzzy Hash: 09486536a25d47e1929a8e49fc6413ba2e156bdee1ff5b80abc56827f65197b5
Instruction Fuzzy Hash: 1BF136B4A042298FCB24EF74DD58B9DB7B6AF88205F1085E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD2D9 Relevance: 1.9, APIs: 1, Instructions: 370libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6776fd1aafc4515a7d14a44d14d84e90546ae8b56eef124d3f7cb1292f703a6d
Instruction ID: a6c50a1d9dfcc4b36a2919adc71a19e865e3d3b5c33e530bdd8f9d909213477c
Opcode Fuzzy Hash: 6776fd1aafc4515a7d14a44d14d84e90546ae8b56eef124d3f7cb1292f703a6d
Instruction Fuzzy Hash: 64F127B4A042298FCB24EB75DD58B9DB7B6BF88205F1084E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD321 Relevance: 1.9, APIs: 1, Instructions: 363libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1b06e4fecfdefc4bbb1717b29a9e76f8731ae6a39d27fbe52327c6615891d0f0
Instruction ID: 2aeddaa8593027c8702d6eba130aa4c038edec04658cd3d891ac9fcc685ff97d
Opcode Fuzzy Hash: 1b06e4fecfdefc4bbb1717b29a9e76f8731ae6a39d27fbe52327c6615891d0f0
Instruction Fuzzy Hash: 6DF137B4A042298FCB24EF75DD58B9DB7B6AF88205F1084E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD369 Relevance: 1.9, APIs: 1, Instructions: 356libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 014a84c450d2c312e1a795f3a40e938bb0d74109b031236ff714b1e1ee40de31
Instruction ID: 27e70db8256a87315e0ea50a72559e28a32b2f593889043849ef61c43595fe4f
Opcode Fuzzy Hash: 014a84c450d2c312e1a795f3a40e938bb0d74109b031236ff714b1e1ee40de31
Instruction Fuzzy Hash: 79F137B4A042298FCB24EF75DD58B9DB7B6AF88205F1084E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD3B1 Relevance: 1.8, APIs: 1, Instructions: 347libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03c86120d2821520d24f3fc6e4b7940873c9599647ace659f096e5e3b208dbb5
Instruction ID: 2ccf3711a7590497c6de57d94797ad2af759274a3e07d1268c22fef4a8e695d9
Opcode Fuzzy Hash: 03c86120d2821520d24f3fc6e4b7940873c9599647ace659f096e5e3b208dbb5
Instruction Fuzzy Hash: C3E148B0A042298FCB24EB75DD58B9DB7B6BF88205F1084E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD3ED Relevance: 1.8, APIs: 1, Instructions: 342libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1b2483faacb24e567dee66de4697e78e3d4bb0c50d294944d2542c3a5695c962
Instruction ID: 46f2029c77e5b64046b5b22770456a21aaf9cad108748f34c05ec79e042065d2
Opcode Fuzzy Hash: 1b2483faacb24e567dee66de4697e78e3d4bb0c50d294944d2542c3a5695c962
Instruction Fuzzy Hash: 31E139B4A042298FCB24EB75DD58B9DB7B6BF88205F1084E9D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD435 Relevance: 1.8, APIs: 1, Instructions: 335libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d8ff225bd5e434b27d6897471d766aaf64866d88c82f2e6fe5a71c1ac2321d89
Instruction ID: 6b5b3dcaabb03fee240bb6c3bd0be8436dde14b5ba3684124daa1cc58870732e
Opcode Fuzzy Hash: d8ff225bd5e434b27d6897471d766aaf64866d88c82f2e6fe5a71c1ac2321d89
Instruction Fuzzy Hash: BDE139B4A042298FCB24EB75DC58B9DB7B6BF88205F1084E9D54AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD47D Relevance: 1.8, APIs: 1, Instructions: 328libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9f0ac8ecb4b71695d07d393b6ecb39b8df71cbff175a6b12674f3593bc7ac5a6
Instruction ID: f43cab67b098cb9a2dcedb771e52b9459cecaead2b3d38bc37fd2aae6a6755a0
Opcode Fuzzy Hash: 9f0ac8ecb4b71695d07d393b6ecb39b8df71cbff175a6b12674f3593bc7ac5a6
Instruction Fuzzy Hash: 0BE13AB4A042298FCB24EB75DC58B9DB7B6BF88205F1084E9D54AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD4C5 Relevance: 1.8, APIs: 1, Instructions: 321libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cd60426d1d703bc0730787883198a2a771e311b9fe55be094e51d69c2e395899
Instruction ID: 02fd5676a511186f50cf0d00f5302f6b458edeae87ce1528eed804aed88e8068
Opcode Fuzzy Hash: cd60426d1d703bc0730787883198a2a771e311b9fe55be094e51d69c2e395899
Instruction Fuzzy Hash: 2DD14CB4A042298FCB24EB75DC58B9DB7B6BF88205F1084E9D54AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD50D Relevance: 1.8, APIs: 1, Instructions: 314libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ba644953381ac29f92987282eed4853960c2678c647591e7b0e7b120da9d5a2b
Instruction ID: 2fed95cb6de76ae4c52dbe350b2cb957058d4ec1e5ff32db4d2e17b8b5453a9a
Opcode Fuzzy Hash: ba644953381ac29f92987282eed4853960c2678c647591e7b0e7b120da9d5a2b
Instruction Fuzzy Hash: 55D13BB5A042298FCB24EB75DC58B9DB7B6BF88205F1084E5D50AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05EDD555 Relevance: 1.8, APIs: 1, Instructions: 307libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05EDD6A7

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48e8964ee1a6b5bbd41eb1f4336a5f351f3590a0ad8d8e91ccbd7782e359556b
Instruction ID: e07e559f195647d5919fc59961dea01effb875548de31acdf9a367f9f802211e
Opcode Fuzzy Hash: 48e8964ee1a6b5bbd41eb1f4336a5f351f3590a0ad8d8e91ccbd7782e359556b
Instruction Fuzzy Hash: 48D13BB5A052298FCB24EF75DC58B9DB6B6BF88205F1084E5E40AE3350DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D4B8 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

FindFirstVolumeMountPointW.KERNEL32 ref: 00F6D5EC

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: FindFirstMountPointVolume
String ID:
API String ID: 1565321653-0
Opcode ID: 60152c354b29d3693f4c5b3c90b4072db4884f24749e38515e7287fb32667c72
Instruction ID: 2559a8e9adaf18149e103d921c71ac5e5e58ae378959c6145d3f6853d358a40b
Opcode Fuzzy Hash: 60152c354b29d3693f4c5b3c90b4072db4884f24749e38515e7287fb32667c72
Instruction Fuzzy Hash: 88413532F083504FDB294A79886027E37E6AB85368F2D407AD807CB795DF75CC09A752

Uniqueness

Uniqueness Score: -1.00%

Function 05EDB0C7 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05EDB20B

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3e7dc0685b1d096ec7f7cc0ed5b1987245c5a28fc65d9fb466b6b4552db193ae
Instruction ID: 895e8c8972c1c00ead0fee81fb5fb64e26e5d0e8db7698e3bedb9134a9d12fe9
Opcode Fuzzy Hash: 3e7dc0685b1d096ec7f7cc0ed5b1987245c5a28fc65d9fb466b6b4552db193ae
Instruction Fuzzy Hash: 585132B5D002188FDB08CFA9D885BDDFBB5BF48318F15942AD819AB354E7749845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05ED8E0C Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05EDB20B

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9f4944ccd661fcbce19e1c3fd2ee8c4abcd1b1d0862196f56b333542d20421b2
Instruction ID: 2221b261de965d2b4b8f1ab26abf2957c6cbcac87481ea0101b299c48b03ace9
Opcode Fuzzy Hash: 9f4944ccd661fcbce19e1c3fd2ee8c4abcd1b1d0862196f56b333542d20421b2
Instruction Fuzzy Hash: 5A5100B1E002188FDB18CFA9C888B9DFBB5BF48314F159529E855AB390E7749845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E2C748 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a81a9a106e5393cf7f0af42e81fc55ec243b6f8c01c224c03da5796b6a3273
Instruction ID: cfd70fe2ca0d13ffd4e11a848897e59d55771e3833a1825d640e5dbdc0ccb91f
Opcode Fuzzy Hash: d0a81a9a106e5393cf7f0af42e81fc55ec243b6f8c01c224c03da5796b6a3273
Instruction Fuzzy Hash: 4A411372D083598FCB04CB79D8006AEBBF1AF8A214F1585ABD508E7381DB749885CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F65184 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F652A2

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3bb27aca5cefeaa647199d9cb66ca1a5b1d884fd3b20b99020fff055d2aa1cfd
Instruction ID: af9ccf308700372fe674cdb50f900d590e7c7cdf890b1008b7806990ec8c4567
Opcode Fuzzy Hash: 3bb27aca5cefeaa647199d9cb66ca1a5b1d884fd3b20b99020fff055d2aa1cfd
Instruction Fuzzy Hash: 1051CEB1D10309DFDB14CF99D884ADEBBB5BF88714F24812AE819AB210D7749985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F65190 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00F652A2

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 15b68c8238855d89442934bf2f269a8eadb878633352016ff3f88c9157a7b502
Instruction ID: 3146717b0eb9a5178ad864e45cef07ed0b9b7422d34401c7ae5d7fb61c94e934
Opcode Fuzzy Hash: 15b68c8238855d89442934bf2f269a8eadb878633352016ff3f88c9157a7b502
Instruction Fuzzy Hash: E241CDB1D10309DFDF14CF99D984ADEBBB5BF88714F24812AE819AB210D774A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F66964 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F67D01

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1592dc7ff11ec913390877aea4338453c63862d94ccd0d037c916ca4eb97e199
Instruction ID: c372499b1c07b5c619a0fc114fc9dbc1035865653ec2d43528448b225e4017be
Opcode Fuzzy Hash: 1592dc7ff11ec913390877aea4338453c63862d94ccd0d037c916ca4eb97e199
Instruction Fuzzy Hash: 1C411AB5A04309CFCB14DF59C448AAABBF5FF88328F24C459E519AB325D774A841DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05ED3D77 Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 05ED3E4A

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d1353b2e1be3a84843ad80c48d63506f8d59d17da1166409e864fd0f0a5d51e4
Instruction ID: 179bc73c3834799f10caac227dc5d925cb6ec7181f5476cfe4156ed16ffce7b3
Opcode Fuzzy Hash: d1353b2e1be3a84843ad80c48d63506f8d59d17da1166409e864fd0f0a5d51e4
Instruction Fuzzy Hash: 943125B0D043489FDB14CFA9D98579EFBB1FB08314F148929E855AB380D7749886CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05ED3D80 Relevance: 1.6, APIs: 1, Instructions: 86libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 05ED3E4A

Memory Dump Source

Source File: 00000004.00000002.513339420.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ed0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cc72e64f9af7dadf7c3153ee38562a09bd35a4757b783368433543972f12bbd6
Instruction ID: b656d99f5587861945671dccdd71e3a9e2d985907dd73365cac8a9dab4bb7f01
Opcode Fuzzy Hash: cc72e64f9af7dadf7c3153ee38562a09bd35a4757b783368433543972f12bbd6
Instruction Fuzzy Hash: FC3134B0D043489FDB14CFA9D885B9EFBF1BB08314F108929E855A7380D7749886CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F66D75 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F66DFF

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dfc741340650e44a0ef4206579fe33c410c2653d890e5147c0e4ab929a42c88f
Instruction ID: 5b695e06c7562fff9a6650c2c77eb75ef727bee01ccf026ca95b48a6a16576a2
Opcode Fuzzy Hash: dfc741340650e44a0ef4206579fe33c410c2653d890e5147c0e4ab929a42c88f
Instruction Fuzzy Hash: 1F2114B59012489FCB00CFA9D984ADEFBF4FB48324F14841AE914A7310D374A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F66D78 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F66DFF

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0205c8556c7d280a13bfa0be19008bd630437721b0abc46b7d25362c93534aa2
Instruction ID: 6fb325b7934a9788e2da662eccd7cde181fce0af2216417b71a259f589ed74cc
Opcode Fuzzy Hash: 0205c8556c7d280a13bfa0be19008bd630437721b0abc46b7d25362c93534aa2
Instruction Fuzzy Hash: D021E2B59002089FDB10CFAAD984ADEFBF8FB48324F14841AE914A7310D374A954DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6BDE8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00F6BE72

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 7cbad59786956657b6abf441abc002fc2848c8691de1e12a8feb1c76cbf1d7bc
Instruction ID: 5c8d60312c71b2393bc1945d4fe0a6cb9e077e9c950fe13dc2aef687f6cf69b8
Opcode Fuzzy Hash: 7cbad59786956657b6abf441abc002fc2848c8691de1e12a8feb1c76cbf1d7bc
Instruction Fuzzy Hash: FC21A7B19053458FCB20DFA9C8483EEBFF0EB1A314F24856AD448E7282C7395588CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2299C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00E2C79A), ref: 00E2C887

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 998cccbe539df9a1eb675cec116031bbe5bdcfe1ec5abc36e09b39d5bcd37422
Instruction ID: c45d750ad9930709e94e3aeb81795a9e86c3888805b498048e8b4c23e647d782
Opcode Fuzzy Hash: 998cccbe539df9a1eb675cec116031bbe5bdcfe1ec5abc36e09b39d5bcd37422
Instruction Fuzzy Hash: DE1133B1C046699BCB04CF9AD544BDEFBF4EB48324F15856AE818B7240D378A944CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6BDF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00F6BE72

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: f9f196f753674cf4f4af9e21810b85640b6f3c74334e37e3b37a0af50510c6f2
Instruction ID: cd955609e102542f6bc7f2dfa8d3abd7885dd7b5bd9080f142ff9159447bd78c
Opcode Fuzzy Hash: f9f196f753674cf4f4af9e21810b85640b6f3c74334e37e3b37a0af50510c6f2
Instruction Fuzzy Hash: DC1164B1D013098FDB20DFAAD5087DEBBF4EB59324F208529D508A3285C7796988CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E2C818 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00E2C79A), ref: 00E2C887

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: beceacabecfbd58bdefc6a0e6d8750fcbd868114a5f82d158377d5031a2d8f6c
Instruction ID: 4996ce2fe4c3f9d990529a02bd3523c3362f25d923cc5959f06d087c38a51a48
Opcode Fuzzy Hash: beceacabecfbd58bdefc6a0e6d8750fcbd868114a5f82d158377d5031a2d8f6c
Instruction Fuzzy Hash: ED1130B1C046698BCB04CFAAD544BDEFBF0AF48324F15856AD418B7240D378AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E22D58 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryTransactedW.KERNEL32(00000000), ref: 00E22D9D

Memory Dump Source

Source File: 00000004.00000002.509028836.0000000000E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_e20000_RegSvcs.jbxd

Similarity

API ID: CreateDirectoryTransacted
String ID:
API String ID: 3398158531-0
Opcode ID: 840d9ec30d512339012eff748739f3386fd0bff5e32257b8ef532efd032c2f00
Instruction ID: 448eba09aa78e0beabc26f43608bf2cba29860299f246ccaf58d7c058d2c978f
Opcode Fuzzy Hash: 840d9ec30d512339012eff748739f3386fd0bff5e32257b8ef532efd032c2f00
Instruction Fuzzy Hash: F7F01275F042295F8B40ABB9581979F7AF5EF8C651B1005B5D90AF3300EF348E068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509123793.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86c451369d0d7f198914572d3b82a7258c4783645eea095cbd219e514bd094d
Instruction ID: 4189256c6594c3f7c8594206722606ecfdb9443bfc8b7f66054fc8caa958fcb5
Opcode Fuzzy Hash: d86c451369d0d7f198914572d3b82a7258c4783645eea095cbd219e514bd094d
Instruction Fuzzy Hash: C32142B1508204EFCF15DF00DDC0BA7BF65FB98328F248569E8099B246D336D856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509156648.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ecd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eeb47979e2f73f6b61c444d690d8be606b1e748822f904828bdd28344caeb0d
Instruction ID: 598aa88e8011b429bad3f01c3c4367cc8f5c4e81f910604959e05fe3caec32c1
Opcode Fuzzy Hash: 5eeb47979e2f73f6b61c444d690d8be606b1e748822f904828bdd28344caeb0d
Instruction Fuzzy Hash: 7A21F171608204DFCB10CF18DAC1F26BB66EB84318F20C57DD8095B246C337D847DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509156648.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ecd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d7e1106d78a82ce141b49852bcac295aabd7447e911728946c9b2957634ecc
Instruction ID: f1d6195ecd295762ba5abb9e3b6285abbc812848e7db4904492cc54b5ff23fd3
Opcode Fuzzy Hash: 12d7e1106d78a82ce141b49852bcac295aabd7447e911728946c9b2957634ecc
Instruction Fuzzy Hash: 90217F7550D3808FDB02CF24D990B15BF71EB46214F28C5EAD8498B697C33B980BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509123793.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ebd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af74d119f5eccf0fc27d3fcee38edaf6600dc4b2768a2458d5ce5b639dbddb0b
Instruction ID: 24ec64c860ff128cb1776eb393c0c627a34bf2a3f0aa0d8d47ac41aa25c5fda0
Opcode Fuzzy Hash: af74d119f5eccf0fc27d3fcee38edaf6600dc4b2768a2458d5ce5b639dbddb0b
Instruction Fuzzy Hash: 94113872408284CFCF12CF00D9C0B56BF72FB94328F24C6A9D8084B61AC336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F67878 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.509334433.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f60000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ad32dd9d5889660feb6a1211e124e2a6a2d66c2cfdcb1b8e63be527a005329
Instruction ID: 135baa6c7eb97bb29702d466cf3714ce1ac6c202780ef24b2d912fa75a1b9894
Opcode Fuzzy Hash: c3ad32dd9d5889660feb6a1211e124e2a6a2d66c2cfdcb1b8e63be527a005329
Instruction Fuzzy Hash: 80D05E3544C2445FC7039B6098008847FB5AF4B30031440ABB500CB5B3D26A4539D700

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2C01EPgbbjrSPr7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2C01EPgbbjrSPr7.exe.log

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

Windows Analysis Report
2C01EPgbbjrSPr7.exe

Function 02DA0040 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Function 02DAA850 Relevance: 3.9, Strings: 3, Instructions: 148
COMMON

Function 02DA9E90 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Function 02DA9E81 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Function 02DAA83F Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Function 02DA0007 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Function 02DAC418 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Function 02DAAAB5 Relevance: 1.6, APIs: 1, Instructions: 80
windowCOMMON

Function 02DAC9C0 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Function 02DAC848 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 02DAC788 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Function 02DA5BF8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Function 02DA5BF0 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre